CVE-2018-10908

published 2018-08-09

CVE-2018-10908: It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an…

medium 6.3 CVSS 3.0

AV L AC L PR N UI R S C C N I N A H

It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
ovirt	vdsm	< 4.20.37	4.20.37
redhat	virtualization	—	—

CWE-20 CWE-770