It was found that the oVirt storage back end did not wipe memory snapshots when VMs were deleted, even if wipe-after-delete (WAD) was enabled for the VM's disks. A remote attacker with credentials to create a new VM could use this flaw to potentially access the contents of memory snapshots in an uninitialized storage volume, possibly leading to the disclosure of sensitive information.
This issue was discovered by Idan Shaby and Allon Mureinik of Red Hat.
This issue has been addressed in following products:
RHEV Manager version 3.4
Via RHSA-2014:1002 https://rhn.redhat.com/errata/RHSA-2014-1002.html