CVE-2018-1062: Medium severity ovirt vulnerability
A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.
Other sources
In oVirt 4.1, the Enable Discard feature was introduced. This was found to be unreliable in combination with Wipe After Delete (WAD), in that a VM Disk with both flags configured could be removed from a VM and not have all of its blocks wiped. If the same storage pages were then assigned to another Virtual Machine, potentially sensitive data could be read from those pages instead of zeroes.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-1062.
What is the severity of CVE-2018-1062?
The severity of CVE-2018-1062 is medium with a severity value of 5.3.
What is the affected software for CVE-2018-1062?
The affected software for CVE-2018-1062 is oVirt 4.1.x before 4.1.9.
How can CVE-2018-1062 be exploited?
CVE-2018-1062 can be exploited when the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt is used, which could cause a disk to be incompletely zeroed when removed from a VM.
How can CVE-2018-1062 be fixed?
CVE-2018-1062 can be fixed by updating oVirt to version 4.1.9.