Bug 1360220

Summary:	vdsm: Volume is removed even if wiping fails
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aavati, alonbl, amureini, bazulay, bmcclain, danken, dblechte, dkenigsb, eedri, gklein, lpeer, lsurette, mgoldboi, michal.skrivanek, rfortier, sabose, security-response-team, sherold, sisharma, smohan, srevivo, ssaha, vbellur, ycui, ykaul, ylavi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-03 08:09:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1359859, 1370619, 1370620
Bug Blocks:	1360221

Description Adam Mariš 2016-07-26 09:30:29 UTC

If wipe after removal is enabled and volume zeroing fails when removing volume, it's still removed with the original data unwiped.

Product bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1359859

Comment 1 Allon Mureinik 2016-07-26 09:38:23 UTC

Some additional details:

The vulnerability was introduced to upstream codebase by dd3306d, merged on 29/05/2016.

RHV customers with early access to beta versions were exposed to it in the first published beta. The next beta refresh will fix this.

Comment 4 Kurt Seifried 2016-08-26 19:30:50 UTC

Created vdsm tracking bugs for this issue:

Affects: fedora-23 [bug 1370619]
Affects: epel-6 [bug 1370620]

Comment 5 Kurt Seifried 2016-08-26 19:33:01 UTC

This was fixed in RHEV 4.0 GA.