← Vulnerability feed

Vulnerability record · CVE-2012-5625 · published 26 December 2012

CVE-2012-5625: Openstack folsom information exposure vulnerability

Openstack · Folsom

OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).

4.3 CVSS 2.0 Medium EPSS 2.0% · top 19.9% CWE-200 · Information exposure
4.3CVSS 2.0 base score
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
20References
16 Jun 2026Last modified by NVD

Description

OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).

AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://osvdb.org/88419
http://rhn.redhat.com/errata/RHSA-2013-0208.html
http://www.openwall.com/lists/oss-security/2012/12/11/5
http://www.securityfocus.com/bid/56904
http://www.ubuntu.com/usn/USN-1663-1 Patch
https://bugs.launchpad.net/nova/+bug/1070539
https://bugzilla.redhat.com/show_bug.cgi?id=884293
https://github.com/openstack/nova/commit/9d2ea970422591f8cdc394001be9a2deca499a5f Patch
https://github.com/openstack/nova/commit/a99a802e008eed18e39fc1d98170edc495cbd354 Patch
https://launchpad.net/nova/folsom/2012.2.2
http://osvdb.org/88419
http://rhn.redhat.com/errata/RHSA-2013-0208.html
http://www.openwall.com/lists/oss-security/2012/12/11/5
http://www.securityfocus.com/bid/56904
http://www.ubuntu.com/usn/USN-1663-1 Patch
https://bugs.launchpad.net/nova/+bug/1070539
https://bugzilla.redhat.com/show_bug.cgi?id=884293
https://github.com/openstack/nova/commit/9d2ea970422591f8cdc394001be9a2deca499a5f Patch
https://github.com/openstack/nova/commit/a99a802e008eed18e39fc1d98170edc495cbd354 Patch
https://launchpad.net/nova/folsom/2012.2.2

Track CVE-2012-5625 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2013-0261Openstack essex link following vulnerabilityA flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the `/tmp` directory. This …EPSS 0.34%7.6CVE-2013-0335Openstack essex insufficient session expiration vulnerabilityOpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circu…EPSS 2.1%7.5CVE-2013-2161Openstack folsom code injection vulnerabilityXML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift r…EPSS 1.9%7.1CVE-2013-7130Openstack compute information exposure vulnerabilityThe i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, w…EPSS 2.4%6.8CVE-2013-1865Openstack folsom improper authentication vulnerabilityOpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remot…EPSS 2.6%6.5CVE-2013-0208Openstack essex permissions and access controls vulnerabilityThe boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from ot…EPSS 2.5%6.4CVE-2013-4497Openstack havana permissions and access controls vulnerabilityThe XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an…EPSS 1.8%5.5CVE-2013-0266Openstack essex incorrect default permissions vulnerabilityA flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world…EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2012-5625), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.