CVE-2018-10908

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.

Metrics

CVSS 3.0 6.3/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-770

Affected software

Vendor	Product	Versions
[UNKNOWN]	vdsm	4.20.37

References

http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.htmlMailing List, Vendor Advisory
https://access.redhat.com/errata/RHEA-2018:2624Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10908Issue Tracking, Patch, Third Party Advisory
https://gerrit.ovirt.org/#/c/93195/Patch, Third Party Advisory
http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.htmlMailing List, Vendor Advisory
https://access.redhat.com/errata/RHEA-2018:2624Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10908Issue Tracking, Patch, Third Party Advisory
https://gerrit.ovirt.org/#/c/93195/Patch, Third Party Advisory

Timeline

Published: Aug 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-10915.5In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be trigge CVE-2018-109103.3A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This si CVE-2018-109117.5A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this fla CVE-2018-109124.9keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mi CVE-2018-109136.5An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to de CVE-2018-109146.5It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a CVE-2018-109157.5A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between co CVE-2018-109166.5It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integr CVE-2018-109176.5pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to l CVE-2018-109186.5A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker c CVE-2018-109196.5The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authent CVE-2018-10925.5The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_co