CVE-2018-1087
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.
Published : 2018-05-15 16:29 Updated : 2019-10-09 23:38
CVSS Score
More info
Score 4.6 / 10
A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account. Examples of locally exploitable vulnerabilities are peripheral attacks such as Firewire/USB DMA attacks, and local privilege escalations (e.g., sudo).
Specialized access conditions or extenuating circumstances do not exist. The following are examples:
- The affected product typically requires access to a wide range of systems and users, possibly anonymous and untrusted (e.g., Internet-facing web or mail server).
- The affected configuration is default or ubiquitous.
- The attack can be performed manually and requires little skill or additional information gathering.
- The race condition is a lazy one (i.e., it is technically a race but easily winnable).
Authentication is not required to exploit the vulnerability.
There is considerable informational disclosure. Access to some system files is possible, but the attacker does not have control over what is obtained, or the scope of the loss is constrained. An example is a vulnerability that divulges only certain tables in a database.
Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited. For example, system or application files may be overwritten or modified, but either the attacker has no control over which files are affected or the attacker can modify files within only a limited context or scope.
There is reduced performance or interruptions in resource availability. An example is a network-based flood attack that permits a limited number of successful connections to an Internet service.
| Vendor | Product | Version | URI |
|---|---|---|---|
| Canonical | Ubuntu Linux | 14.04 | cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ |
| Canonical | Ubuntu Linux | 16.04 | cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ |
| Canonical | Ubuntu Linux | 17.10 | cpe:/o:canonical:ubuntu_linux:17.10 |
| Debian | Debian Linux | 8.0 | cpe:/o:debian:debian_linux:8.0 |
| Debian | Debian Linux | 9.0 | cpe:/o:debian:debian_linux:9.0 |
| Linux | Linux Kernel | 4.16 | cpe:/o:linux:linux_kernel:4.16 |
| Linux | Linux Kernel | 4.16 | cpe:/o:linux:linux_kernel:4.16:rc7 |
| Linux | Linux Kernel | 4.17 | cpe:/o:linux:linux_kernel:4.17:rc1 |
| Linux | Linux Kernel | 4.17 | cpe:/o:linux:linux_kernel:4.17:rc2 |
| Linux | Linux Kernel | 4.17 | cpe:/o:linux:linux_kernel:4.17:rc3 |
| Redhat | Enterprise Linux | 7.0 | cpe:/o:redhat:enterprise_linux:7.0 |
| Redhat | Enterprise Linux Desktop | 7.0 | cpe:/o:redhat:enterprise_linux_desktop:7.0 |
| Redhat | Enterprise Linux Server | 7.0 | cpe:/o:redhat:enterprise_linux_server:7.0 |
| Redhat | Enterprise Linux Server Aus | 7.2 | cpe:/o:redhat:enterprise_linux_server_aus:7.2 |
| Redhat | Enterprise Linux Server Aus | 7.3 | cpe:/o:redhat:enterprise_linux_server_aus:7.3 |
| Redhat | Enterprise Linux Server Aus | 7.4 | cpe:/o:redhat:enterprise_linux_server_aus:7.4 |
| Redhat | Enterprise Linux Server Eus | 7.3 | cpe:/o:redhat:enterprise_linux_server_eus:7.3 |
| Redhat | Enterprise Linux Server Eus | 7.4 | cpe:/o:redhat:enterprise_linux_server_eus:7.4 |
| Redhat | Enterprise Linux Server Eus | 7.5 | cpe:/o:redhat:enterprise_linux_server_eus:7.5 |
| Redhat | Enterprise Linux Server Tus | 7.2 | cpe:/o:redhat:enterprise_linux_server_tus:7.2 |
| Redhat | Enterprise Linux Server Tus | 7.3 | cpe:/o:redhat:enterprise_linux_server_tus:7.3 |
| Redhat | Enterprise Linux Server Tus | 7.4 | cpe:/o:redhat:enterprise_linux_server_tus:7.4 |
| Redhat | Enterprise Linux Virtualization | 4.0 | cpe:/o:redhat:enterprise_linux_virtualization:4.0 |
| Redhat | Enterprise Linux Workstation | 7.0 | cpe:/o:redhat:enterprise_linux_workstation:7.0 |
-
Canonical (1) Search CVE
-
Ubuntu Linux (3) Search CVE
-
14.04
-
16.04
-
17.10
-
-
-
Linux (1) Search CVE
-
Linux Kernel (2) Search CVE
-
4.16
-
4.17
-
-
-
Redhat (8) Search CVE
-
Enterprise Linux Virtualization (1) Search CVE
-
4.0
-
-
Enterprise Linux Server Eus (3) Search CVE
-
7.3
-
7.4
-
7.5
-
-
Enterprise Linux Desktop (1) Search CVE
-
7.0
-
-
Enterprise Linux Workstation (1) Search CVE
-
7.0
-
-
Enterprise Linux (1) Search CVE
-
7.0
-
-
Enterprise Linux Server (1) Search CVE
-
7.0
-
-
Enterprise Linux Server Aus (3) Search CVE
-
7.2
-
7.3
-
7.4
-
-
Enterprise Linux Server Tus (3) Search CVE
-
7.2
-
7.3
-
7.4
-
-
-
Debian (1) Search CVE
-
Debian Linux (2) Search CVE
-
8.0
-
9.0
-
-
CWE
There is no CWE for this CVE.
References
History of changes
| Date | Event | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019-10-03 00:03 |
|
||||||||||||||||||||||||
| 2018-06-19 18:25 |
24 added
12 changed
|
||||||||||||||||||||||||
| 2018-05-30 01:29 |
1 added
|
||||||||||||||||||||||||
| 2018-05-17 01:29 |
10 added
|
||||||||||||||||||||||||
| 2018-05-15 16:29 |
New CVE |