Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2010-2223 vdsm: missing VM post-zeroing after removal|
|Product:||[Other] Security Response||Reporter:||Petr Matousek <pmatouse>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||VERIFIED ---||QA Contact:|
|Version:||unspecified||CC:||mjc, mprpic, security-response-team|
|Fixed In Version:||Doc Type:||Bug Fix|
Previously, the ISO image domain could not be shared with multiple Data Centers. The user had to define an independent ISO domain for each Data Center. With this update, the ISO image domain can be shared between multiple Data Centers.
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||524809, 547684, 604841|
Description Petr Matousek 2010-06-16 12:43:15 EDT
A flaw was found in the way the Virtual Desktop Server Manager (VDSM) handled the removal of a virtual machine's (VM) data back end (such as an image or a volume). When removing an image or a volume, it was not securely deleted from its corresponding data domain as expected. A guest user in a new, raw VM, created in a data domain that has had VMs deleted from it, could use this flaw to read limited data from those deleted VMs, potentially disclosing sensitive information.
Comment 2 errata-xmlrpc 2010-06-22 08:44:20 EDT
This issue has been addressed in following products: Red Hat Enterprise Virtualization for RHEL-5 Via RHSA-2010:0473 https://rhn.redhat.com/errata/RHSA-2010-0473.html
Comment 3 Mark J. Cox (Product Security) 2010-06-22 09:01:36 EDT
Comment 4 errata-xmlrpc 2010-06-22 09:54:11 EDT
This issue has been addressed in following products: Red Hat Enterprise Virtualization for RHEL-5 Via RHSA-2010:0476 https://rhn.redhat.com/errata/RHSA-2010-0476.html
Comment 5 Martin Prpic 2010-06-25 07:35:50 EDT
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Previously, the ISO image domain could not be shared with multiple Data Centers. The user had to define an independent ISO domain for each Data Center. With this update, the ISO image domain can be shared between multiple Data Centers.