CVE-2017-15139

An information-leak flaw was found in openstack-cinder deployments using the third-party EMC ScaleIO backend. It was possible for new volumes to contain previous data if they were created from storage pools which had disabled zero-padding. An attacker could exploit this flaw to obtain sensitive information.

Mitigation

This flaw only affects Red Hat OpenStack Platform deployments which use the third-party EMC ScaleIO driver plugin. To mitigate this flaw, ensure all volumes use zero-padding by updating the ScaleIO storage-pool policy.
Note: Only an empty pool's policy can be changed.

scli --modify_zero_padding_policy  
   (((--protection_domain_id <ID> |  
   --protection_domain_name <NAME>)  
   --storage_pool_name <NAME>) | --storage_pool_id <ID>)  
   (--enable_zero_padding | --disable_zero_padding)  
  
Example:  
scli --modify_zero_padding_policy  
--protection_domain_name pd10 --storage_pool_name scale1  
--enable_zero_padding