CVE-2018-10908 Denial of service in vdsm
An attacker can cause a denial of service by uploading a crafted image that exhausts host resources via qemu-img, affecting virtualization hosts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10908?
CVE-2018-10908 is a medium-severity denial of service vulnerability in Redhat Virtualization, published on 9 Aug 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
Which versions are affected by CVE-2018-10908?
It affects 2 products.
Linux distribution packages (21)
vdsm Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-api Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-client Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-common Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-gluster Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-checkips Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-cpuflags Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-ethtool-options Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-extra-ipv4-addrs Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-fcoe Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-localdisk Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-macspoof Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-nestedvt Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-openstacknet Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-vhostmd Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-hook-vmfex-dev Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-http Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-jsonrpc Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-network Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-python Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
vdsm-yajsonrpc Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.20.39-1.el7ev |
Products include Ovirt Vdsm, Redhat Virtualization.
How do I fix CVE-2018-10908?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-10908 being exploited?
There is no known exploitation of CVE-2018-10908 in the wild and no public exploit code.
Other vulnerabilities in Redhat Virtualization
Sources
Also known as GHSA-c34h-7mjf-54vf, RHEA-2018:2624.