vulnwire
8.0high

CVE-2018-1087

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in th…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
8.0
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 55%
Public exploits
0
none known

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.

Exploit prediction (EPSS)

0.74% probability of exploitation in the next 30 days, higher than 55% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.08.0CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA3.08.0CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD3.07.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • kernel KVM

Classification

Weakness
  • CWE-250 Execution with Unnecessary Privileges
Technology feeds
Linux kernel (RSS, critical only)

References

  • access.redhat.com /errata/RHSA-2018:1347 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2018-1087 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1040862 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • access.redhat.com /errata/RHSA-2018:1348 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2018/dsa-4196 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2018:1355 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1345 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /security/vulnerabilities/pop_ss · x_refsource_MISC, x_transferred
  • access.redhat.com /errata/RHSA-2018:1318 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1524 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • openwall.com /lists/oss-security/2018/05/08/5 · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/104127 · vdb-entry, x_refsource_BID, x_transferred
  • usn.ubuntu.com /3641-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • usn.ubuntu.com /3641-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.