Vulnerability in Kernel Kvm
CVE-2018-1087
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Kernel Kvm — versions kernel 4.17-rc3, kernel 4.16-rc7, kernel 4.17-rc2
- Linux Kernel — versions 4.16, 4.17
- Canonical Ubuntu Linux — versions 14.04, 16.04, 17.10
- Debian Linux — versions 8.0, 9.0
- Red Hat Enterprise Linux — versions 7.0
- Red Hat Enterprise Linux Desktop — versions 7.0
- Red Hat Enterprise Linux Server — versions 7.0
- Red Hat Enterprise Linux Server Aus — versions 7.2, 7.3, 7.4
- Red Hat Enterprise Linux Server Eus — versions 7.3, 7.4, 7.5
- Red Hat Enterprise Linux Server Tus — versions 7.2, 7.3, 7.4
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2018:1347 (vendor-advisory, Third Party Advisory)
- bugzilla.redhat.com/show_bug.cgi (Issue Tracking)
- www.securitytracker.com/id/1040862 (VDB Entry, Third Party Advisory, vdb-entry)
- access.redhat.com/errata/RHSA-2018:1348 (vendor-advisory, Third Party Advisory)
- www.debian.org/security/2018/dsa-4196 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:1355 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:1345 (vendor-advisory, Third Party Advisory)
- access.redhat.com/security/vulnerabilities/pop_ss (Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:1318 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:1524 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-1087?
- CVE-2018-1087 is a high-severity vulnerability in Kernel Kvm, classified under CWE-250. CVSS score: 8.0/10. Published 2018-05-15.
- How severe is CVE-2018-1087?
- High severity. CVSS v3 base score is 8.0 out of 10.