CVE-2012-5625: n/a vulnerability

CVE-2012-5625: OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, d...

OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).

UnknownCVSS not scoredNot KEV-listedUpdatedAug 6, 2024, 21:14 UTC (UTC+00:00)

Security readout for executives and security teams

CVE-2012-5625 is a data leakage flaw in OpenStack Nova. In affected deployments, storage reused for a new virtual machine may still contain data from a previous instance. The business risk is cross-tenant exposure of sensitive data in older OpenStack clouds using libvirt with LVM-backed instances. Exposure is limited to OpenStack Nova environments matching the vulnerable configuration: Folsom before 2012.2.2 or affected Grizzly builds, using libvirt and LVM-backed instances. Clouds using different storage backends are not shown affected by the provided sources. Prioritize remediation if any legacy OpenStack cloud used affected Nova versions with LVM-backed instances. The core concern is possible tenant-to-tenant data exposure, not system takeover. If the configuration is absent, business urgency drops substantially. Mitigation focus: Upgrade Nova Folsom deployments to 2012.2.2 or later vendor-fixed packages.; Apply the relevant Nova upstream fixes if maintaining source-based deployments.; Check Red Hat and Ubuntu advisories for distribution-specific fixed package versions..

Prepared: Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2012-5625 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Dec 26, 2012, 22:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://bugs.launchpad.net/nova/+bug/1070539CVE reference · x_refsource_CONFIRM
https://launchpad.net/nova/folsom/2012.2.2CVE reference · x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=884293CVE reference · x_refsource_MISC
https://github.com/openstack/nova/commit/a99a802e008eed18e39fc1d98170edc495cbd354CVE reference · x_refsource_CONFIRM
https://github.com/openstack/nova/commit/9d2ea970422591f8cdc394001be9a2deca499a5fCVE reference · x_refsource_CONFIRM

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.