It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
References
| Link | Resource |
|---|---|
| http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.html | Mailing List Vendor Advisory |
| https://access.redhat.com/errata/RHEA-2018:2624 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10908 | Issue Tracking Patch Third Party Advisory |
| https://gerrit.ovirt.org/#/c/93195/ | Patch Third Party Advisory |
| http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.html | Mailing List Vendor Advisory |
| https://access.redhat.com/errata/RHEA-2018:2624 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10908 | Issue Tracking Patch Third Party Advisory |
| https://gerrit.ovirt.org/#/c/93195/ | Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 03:42
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 7.1
v3 : 6.5 |
| References | () http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.html - Mailing List, Vendor Advisory | |
| References | () https://access.redhat.com/errata/RHEA-2018:2624 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10908 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://gerrit.ovirt.org/#/c/93195/ - Patch, Third Party Advisory |
Information
Published : 2018-08-09 19:29
Updated : 2024-11-21 03:42
NVD link : CVE-2018-10908
Mitre link : CVE-2018-10908
CVE.ORG link : CVE-2018-10908
JSON object : View
Products Affected
redhat
- virtualization
ovirt
- vdsm