CVE-2018-10908
published 2018-08-09CVE-2018-10908: It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an…
PriorityP422medium6.3CVSS 3.0
AVLACLPRNUIRSCCNINAH
EPSS
1.19%
64.3th percentile
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ovirt | vdsm | < 4.20.37 | 4.20.37 |
| redhat | virtualization | — | — |
CVSS provenance
nvdv3.06.3MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c34h-7mjf-54vf: It was found that vdsm before version 4
ghsa_unreviewed·2022-05-13
CVE-2018-10908 [HIGH] CWE-770 GHSA-c34h-7mjf-54vf: It was found that vdsm before version 4
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
Red Hat
vdsm: calls to qemu-img are not protected by prlimit/ulimit
vendor_redhat·2018-08-08·CVSS 6.5
CVE-2018-10908 [MEDIUM] CWE-770 vdsm: calls to qemu-img are not protected by prlimit/ulimit
vdsm: calls to qemu-img are not protected by prlimit/ulimit
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
It was found that vdsm would invoke qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
Statement: Red Hat Enterprise Virtualization 3 is now in Extended Life Ph
No detection rules found.
No public exploits indexed.
http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.htmlhttps://access.redhat.com/errata/RHEA-2018:2624https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10908https://gerrit.ovirt.org/#/c/93195/http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.htmlhttps://access.redhat.com/errata/RHEA-2018:2624https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10908https://gerrit.ovirt.org/#/c/93195/
2018-08-09
Published