CVE-2018-10908
Fixed in a distro release EPSS 1%CVSS 6.5
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
Products: ovirt vdsm, redhat virtualization
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 7 | vdsm | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-api | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-client | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-common | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-gluster | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-checkips | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-cpuflags | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-ethtool-options | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-extra-ipv4-addrs | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-fcoe | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-localdisk | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-macspoof | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-nestedvt | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-openstacknet | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-vhostmd | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-hook-vmfex-dev | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-http | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-jsonrpc | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-network | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-python | 0:4.20.39-1.el7ev |
| Red Hat Enterprise Linux 7 | vdsm-yajsonrpc | 0:4.20.39-1.el7ev |