CVE-2018-10908: Input Validation
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10908?
The severity of CVE-2018-10908 is high with a CVSS score of 6.3.
Which software is affected by CVE-2018-10908?
Ovirt Vdsm before version 4.20.37 and Redhat Virtualization 4.0 are affected by CVE-2018-10908.
How does CVE-2018-10908 impact the system?
CVE-2018-10908 can cause a denial of service condition by consuming excessive memory or CPU time.
Is there a fix available for CVE-2018-10908?
Yes, the fix for CVE-2018-10908 is included in vdsm version 4.20.37 and above.
Where can I find more information about CVE-2018-10908?
You can find more information about CVE-2018-10908 at the following references: http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.html, https://access.redhat.com/errata/RHEA-2018:2624, and https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10908.