CVE-2018-8897 A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulti...
HighCVSS 7.8
EPSS 18.5%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.15.17-1 | 4.15.17-1 |
| debian/linux(Debian:13) | < 4.15.17-1 | 4.15.17-1 |
| debian/linux(Debian:14) | < 4.15.17-1 | 4.15.17-1 |
| debian/xen(Debian:12) | < 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6 | 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6 |
| debian/xen(Debian:13) | < 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6 | 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6 |
| debian/xen(Debian:14) | < 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6 | 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| redhat enterprise virtualization manager | = 3.0 | No fix listed |
| citrix xenserver | = 6.0.2 | No fix listed |
| citrix xenserver | = 6.2.0 | No fix listed |
| citrix xenserver | = 6.5 | No fix listed |
| citrix xenserver | = 7.0 | No fix listed |
| citrix xenserver | = 7.1 | No fix listed |
| citrix xenserver | = 7.2 | No fix listed |
| citrix xenserver | = 7.3 | No fix listed |
| citrix xenserver | = 7.4 | No fix listed |
| Synology skynas | All versions | No fix listed |
| Synology diskstation manager | = 5.2 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Synology diskstation manager | = 6.0 | No fix listed |
| Synology diskstation manager | = 6.1 | No fix listed |
| apple mac os x | < 10.13.4 | 10.13.4 |
| Xen | All versions | No fix listed |
| freebsd | >= 11.0, < 11.1 | 11.1 |
| alpine/xen(Alpine:v3.10) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.12) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.13) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.14) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.15) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.16) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.17) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.18) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.19) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.20) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.21) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.22) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.23) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.24) | < 4.10.1-r1 | 4.10.1-r1 |
| alpine/xen(Alpine:v3.4) | < 4.6.6-r5 | 4.6.6-r5 |
| alpine/xen(Alpine:v3.5) | < 4.7.3-r9 | 4.7.3-r9 |
| alpine/xen(Alpine:v3.6) | < 4.8.3-r1 | 4.8.3-r1 |
| alpine/xen(Alpine:v3.7) | < 4.9.2-r2 | 4.9.2-r2 |
| alpine/xen(Alpine:v3.9) | < 4.10.1-r1 | 4.10.1-r1 |
References
- Debian Security Tracker CVE-2018-8897 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-3641-1 vendor-advisory
- USN-3641-2 vendor-advisory
- www.cve.org
- git.kernel.org patch third-party-advisory
- openwall.com mailing-list third-party-advisory
- openwall.com mailing-list third-party-advisory
- www.huawei.com
- 104071 third-party-advisory vdb-entry
- 1040744 third-party-advisory vdb-entry
- 1040849 third-party-advisory vdb-entry
- 1040861 third-party-advisory vdb-entry
- 1040866 third-party-advisory vdb-entry
- 1040882 third-party-advisory vdb-entry
- RHSA-2018:1318 third-party-advisory vendor-advisory
- RHSA-2018:1319 third-party-advisory vendor-advisory
- RHSA-2018:1345 third-party-advisory vendor-advisory
- RHSA-2018:1346 third-party-advisory vendor-advisory
- RHSA-2018:1347 third-party-advisory vendor-advisory
- RHSA-2018:1348 third-party-advisory vendor-advisory
- RHSA-2018:1349 third-party-advisory vendor-advisory
- RHSA-2018:1350 third-party-advisory vendor-advisory
- RHSA-2018:1351 third-party-advisory vendor-advisory
- RHSA-2018:1352 third-party-advisory vendor-advisory
- RHSA-2018:1353 third-party-advisory vendor-advisory
- RHSA-2018:1354 third-party-advisory vendor-advisory
- RHSA-2018:1355 third-party-advisory vendor-advisory
- RHSA-2018:1524 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com exploit third-party-advisory
- github.com patch third-party-advisory
- help.ecostruxureit.com
- [debian-lts-announce] 20180525 [SECURITY] [DLA 1383-1] xen security update mailing-list third-party-advisory
- [debian-lts-announce] 20180601 [SECURITY] [DLA 1392-1] linux security update mailing-list third-party-advisory
- [debian-lts-announce] 20181112 [SECURITY] [DLA 1577-1] xen security update mailing-list
- patchwork.kernel.org patch third-party-advisory
- portal.msrc.microsoft.com patch third-party-advisory vendor-advisory
- security.netapp.com
- support.apple.com third-party-advisory
- support.citrix.com third-party-advisory
- svnweb.freebsd.org third-party-advisory
- USN-3641-1 third-party-advisory vendor-advisory
- USN-3641-2 third-party-advisory vendor-advisory
- DSA-4196 third-party-advisory vendor-advisory
- DSA-4201 third-party-advisory vendor-advisory
- 44697 exploit third-party-advisory vdb-entry
- 45024 exploit
- www.freebsd.org third-party-advisory
- VU#631579 third-party-advisory
- www.synology.com third-party-advisory
- www.triplefault.io third-party-advisory
- xenbits.xen.org patch third-party-advisory
- security.alpinelinux.org vendor-advisory