CVE-2012-5625
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).
Risk Assessment
An attacker can read data left over from previous instances, leading to sensitive information leakage between tenants. The risk affects OpenStack environments with LVM-backed instances.
Recommendation
Update OpenStack Nova to version 2012.2.2 or later. Consider enabling volume wiping on reallocation.
Other vulnerabilities in OpenStack Nova
See all- CVE-2017-17051High
An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. An authenticated user may repeatedly rebuild an instance with new images, leading to untracked resource consumption on a hypervisor host, resulting in denial of service.
- CVE-2017-7214Critical
An issue was discovered in exception_wrapper.py in OpenStack Nova versions 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.
- CVE-2026-24708High
An issue in OpenStack Nova before versions 30.2.2, 31.2.1, and 32.1.1 allows a user to trigger an unsafe image resize operation by writing a malicious QCOW header to a root or ephemeral disk. This causes the Flat image backend to call qemu-img without format restrictions, potentially destroying data on the host system.
Original NVD description (English source)
OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS