Is CVE-2012-5625 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2012-5625 being exploited in the wild.

How severe is CVE-2012-5625?

Medium severity, with a CVSS score of 4.3, published 17 May 2022.

Which products and versions are affected?

nova (PyPI) ECOSYSTEM:introduced=0,fixed=12.0.0a0, GIT:introduced=0,fixed=a99a802e008eed18e39fc1d98170edc495cbd354,fixed=9d2ea970422591f8cdc394001be9a2deca499a5f|ECOSYSTEM:introduced=0.

Is there a fix for CVE-2012-5625?

Yes. nova (PyPI): upgrade to 12.0.0a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2012-5625 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2012-5625?

Check whether you run nova (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2012-5625: OpenStack Nova information leak in libvirt LVM-backed instances

CVE-2012-5625 · Severity: medium · CVSS 4.3 · Published 2022-05-17

OpenStack Nova, a cloud computing fabric controller, contains a flaw in how it manages virtual machine storage. When using certain storage configurations (LVM-backed instances), the system fails to properly erase data from previously deleted virtual machines before reassigning that storage space to a new user. This could allow a malicious user to read sensitive data belonging to a previous customer, potentially leading to the exposure of private files, credentials, or configuration data.

Technologies: nova (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2012-5625 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2012-5625 being exploited in the wild.
How severe is CVE-2012-5625?: Medium severity, with a CVSS score of 4.3, published 17 May 2022.
Which products and versions are affected?: nova (PyPI) ECOSYSTEM:introduced=0,fixed=12.0.0a0, GIT:introduced=0,fixed=a99a802e008eed18e39fc1d98170edc495cbd354,fixed=9d2ea970422591f8cdc394001be9a2deca499a5f|ECOSYSTEM:introduced=0.
Is there a fix for CVE-2012-5625?: Yes. nova (PyPI): upgrade to 12.0.0a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2012-5625 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2012-5625?: Check whether you run nova (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nova (PyPI): upgrade to 12.0.0a0 or later
```
pip install "nova>=12.0.0a0"
```

Technical details

An information disclosure vulnerability exists in OpenStack Compute (Nova) when using the libvirt driver with LVM-backed instances. The root cause is located in the `create_lvm_image` function (and related LVM management utilities), which fails to zero-out or otherwise sanitize blocks on a Physical Volume (PV) when a Logical Volume (LV) is deleted and its space is reallocated to a new instance. Because LVM performs linear mappings, the new LV may contain residual data from the previous occupant. An attacker provisioned on a newly created LV can read the raw block device to recover sensitive information from the previous tenant. The fix involves implementing a mandatory wipe (zeroing) of the logical volume during the removal process.

Affected products

OpenStack Nova < 12.0.0a0

Identifiers

CVE-2012-5625
GHSA-rwhr-h69g-8qmq
PYSEC-2012-41
PYSEC-2012-42

Timeline

2012-10-23: disclosed: Bug reported on Launchpad
2012-12-11: advisory: OpenStack Security Advisory (OSSA 2012-020) issued
2012-12-26: advisory: NVD published CVE-2012-5625

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.