CVE-2018-1087 kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions de...
HighCVSS 7.8
EPSS 0.74%
- Published
- Updated
- Exploit status
- No public exploit known
Description
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.15.17-1 | 4.15.17-1 |
| debian/linux(Debian:13) | < 4.15.17-1 | 4.15.17-1 |
| debian/linux(Debian:14) | < 4.15.17-1 | 4.15.17-1 |
| Linux kernel | = 4.16 | No fix listed |
| Linux kernel | = 4.16-rc7 | No fix listed |
| Linux kernel | = 4.17-rc1 | No fix listed |
| Linux kernel | = 4.17-rc2 | No fix listed |
| Linux kernel | = 4.17-rc3 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server tus | = 7.2 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux virtualization | = 4.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| kernel KVM | = kernel 4.16 | No fix listed |
| kernel KVM | = kernel 4.16-rc7 | No fix listed |
| kernel KVM | = kernel 4.17-rc1 | No fix listed |
| kernel KVM | = kernel 4.17-rc2 | No fix listed |
| kernel KVM | = kernel 4.17-rc3 | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-3641-1 vendor-advisory
- USN-3641-2 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-1087 vendor-advisory
- www.openwall.com mailing-list
- 104127 third-party-advisory vdb-entry
- 1040862 third-party-advisory vdb-entry
- RHSA-2018:1318 third-party-advisory vendor-advisory
- RHSA-2018:1345 third-party-advisory vendor-advisory
- RHSA-2018:1347 third-party-advisory vendor-advisory
- RHSA-2018:1348 third-party-advisory vendor-advisory
- RHSA-2018:1355 third-party-advisory vendor-advisory
- RHSA-2018:1524 third-party-advisory vendor-advisory
- access.redhat.com third-party-advisory
- bugzilla.redhat.com issue-tracking
- USN-3641-1 third-party-advisory vendor-advisory
- USN-3641-2 third-party-advisory vendor-advisory
- DSA-4196 third-party-advisory vendor-advisory