Vulnerability in Apple Mac OS X
CVE-2018-8897
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.
Vulnerability class: Race Condition
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.185 (97.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.185 · newest: 0.185 · change: 0.000
Affected products
- Apple Mac OS X
- Citrix Xenserver — versions 6.0.2, 6.2.0, 6.5
- FreeBSD
- Synology Diskstation Manager — versions 5.2, 6.0, 6.1
- Synology Skynas
- Xen
- Canonical Ubuntu Linux — versions 14.04, 16.04, 17.10
- Debian Linux — versions 7.0, 8.0, 9.0
- Red Hat Enterprise Linux Server — versions 7.0
- Red Hat Enterprise Linux Workstation — versions 7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 (Patch, Third Party Advisory)
- openwall.com/lists/oss-security/2018/05/08/4 (Mailing List, Third Party Advisory)
- www.securitytracker.com/id/1040849 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securityfocus.com/bid/104071 (VDB Entry, Third Party Advisory, vdb-entry)
- access.redhat.com/errata/RHSA-2018:1350 (vendor-advisory, Third Party Advisory)
- support.citrix.com/article/CTX234679 (Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:1347 (vendor-advisory, Third Party Advisory)
- www.exploit-db.com/exploits/44697/ (Exploit, VDB Entry, Third Party Advisory, exploit)
- lists.debian.org/debian-lts-announce/2018/05/msg00015.html (mailing-list, Third Party Advisory)
- www.securitytracker.com/id/1040866 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-8897?
- CVE-2018-8897 is a high-severity vulnerability in Apple Mac OS X, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.8/10. Published 2018-05-08.
- How severe is CVE-2018-8897?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2018-8897 known to be exploited?
- 46 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.