All the vulnerabilites related to kernel - KVM
cve-2018-1087
Vulnerability from cvelistv5
Published
2018-05-15 16:00
Modified
2024-08-05 03:51
Summary
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.
References
https://access.redhat.com/errata/RHSA-2018:1347vendor-advisory, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087x_refsource_CONFIRM
http://www.securitytracker.com/id/1040862vdb-entry, x_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2018:1348vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2018/dsa-4196vendor-advisory, x_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2018:1355vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:1345vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/vulnerabilities/pop_ssx_refsource_MISC
https://access.redhat.com/errata/RHSA-2018:1318vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:1524vendor-advisory, x_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2018/05/08/5x_refsource_MISC
http://www.securityfocus.com/bid/104127vdb-entry, x_refsource_BID
https://usn.ubuntu.com/3641-2/vendor-advisory, x_refsource_UBUNTU
https://usn.ubuntu.com/3641-1/vendor-advisory, x_refsource_UBUNTU
Impacted products
kernelKVM
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.239Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2018:1347",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1347"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087"
          },
          {
            "name": "1040862",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1040862"
          },
          {
            "name": "RHSA-2018:1348",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1348"
          },
          {
            "name": "DSA-4196",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4196"
          },
          {
            "name": "RHSA-2018:1355",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1355"
          },
          {
            "name": "RHSA-2018:1345",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1345"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/vulnerabilities/pop_ss"
          },
          {
            "name": "RHSA-2018:1318",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1318"
          },
          {
            "name": "RHSA-2018:1524",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1524"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2018/05/08/5"
          },
          {
            "name": "104127",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104127"
          },
          {
            "name": "USN-3641-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3641-2/"
          },
          {
            "name": "USN-3641-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3641-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "KVM",
          "vendor": "kernel",
          "versions": [
            {
              "status": "affected",
              "version": "kernel 4.16"
            },
            {
              "status": "affected",
              "version": "kernel 4.16-rc7"
            },
            {
              "status": "affected",
              "version": "kernel 4.17-rc1"
            },
            {
              "status": "affected",
              "version": "kernel 4.17-rc2"
            },
            {
              "status": "affected",
              "version": "kernel 4.17-rc3"
            }
          ]
        }
      ],
      "datePublic": "2018-05-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel\u0027s KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-29T09:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2018:1347",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1347"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087"
        },
        {
          "name": "1040862",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1040862"
        },
        {
          "name": "RHSA-2018:1348",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1348"
        },
        {
          "name": "DSA-4196",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4196"
        },
        {
          "name": "RHSA-2018:1355",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1355"
        },
        {
          "name": "RHSA-2018:1345",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1345"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/vulnerabilities/pop_ss"
        },
        {
          "name": "RHSA-2018:1318",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1318"
        },
        {
          "name": "RHSA-2018:1524",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1524"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2018/05/08/5"
        },
        {
          "name": "104127",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104127"
        },
        {
          "name": "USN-3641-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3641-2/"
        },
        {
          "name": "USN-3641-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3641-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1087",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "KVM",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "kernel 4.16"
                          },
                          {
                            "version_value": "kernel 4.16-rc7"
                          },
                          {
                            "version_value": "kernel 4.17-rc1"
                          },
                          {
                            "version_value": "kernel 4.17-rc2"
                          },
                          {
                            "version_value": "kernel 4.17-rc3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kernel"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel\u0027s KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "8.0/CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-250"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2018:1347",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1347"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087"
            },
            {
              "name": "1040862",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1040862"
            },
            {
              "name": "RHSA-2018:1348",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1348"
            },
            {
              "name": "DSA-4196",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4196"
            },
            {
              "name": "RHSA-2018:1355",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1355"
            },
            {
              "name": "RHSA-2018:1345",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1345"
            },
            {
              "name": "https://access.redhat.com/security/vulnerabilities/pop_ss",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/vulnerabilities/pop_ss"
            },
            {
              "name": "RHSA-2018:1318",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1318"
            },
            {
              "name": "RHSA-2018:1524",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1524"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2018/05/08/5",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2018/05/08/5"
            },
            {
              "name": "104127",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104127"
            },
            {
              "name": "USN-3641-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3641-2/"
            },
            {
              "name": "USN-3641-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3641-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1087",
    "datePublished": "2018-05-15T16:00:00",
    "dateReserved": "2017-12-04T00:00:00",
    "dateUpdated": "2024-08-05T03:51:48.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}