« Volver al listado

CVE-2018-1087

Estado: ModificadaAlta (7.8)—

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (11)

Canonical — Ubuntu LinuxDebian — Debian LinuxLinux — Linux KernelRedhat — Enterprise LinuxRedhat — Enterprise Linux DesktopRedhat — Enterprise Linux ServerRedhat — Enterprise Linux Server AUSRedhat — Enterprise Linux Server EUSRedhat — Enterprise Linux Server TUSRedhat — Enterprise Linux VirtualizationRedhat — Enterprise Linux Workstation

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-1087",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "kernel",
          "product": "KVM",
          "versions": [
            {
              "status": "affected",
              "version": "kernel 4.16"
            },
            {
              "status": "affected",
              "version": "kernel 4.16-rc7"
            },
            {
              "status": "affected",
              "version": "kernel 4.17-rc1"
            },
            {
              "status": "affected",
              "version": "kernel 4.17-rc2"
            },
            {
              "status": "affected",
              "version": "kernel 4.17-rc3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-05-15T16:29:00.207",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2018/05/08/5",
      "tags": [
        "Mailing List"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/104127",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1040862",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1318",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1345",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1347",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1348",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1355",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1524",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/vulnerabilities/pop_ss",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087",
      "tags": [
        "Issue Tracking"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://usn.ubuntu.com/3641-1/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://usn.ubuntu.com/3641-2/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4196",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2018/05/08/5",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/104127",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1040862",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1318",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1345",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1347",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1348",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1355",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1524",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/security/vulnerabilities/pop_ss",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://usn.ubuntu.com/3641-1/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://usn.ubuntu.com/3641-2/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4196",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest."
    },
    {
      "lang": "es",
      "value": "kernel KVM en versiones anteriores al kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 y kernel 4.17-rc3 es vulnerable a un error en la forma en la que el hipervisor KVM del kernel de Linux gestiona las excepciones lanzadas tras una operación de cambio de pila mediante instrucciones Mov SS o Pop SS. Durante la operación de cambio de pila, el procesador no lanzó interrupciones y excepciones, sino que las lanza una vez se ha ejecutado la primera instrucción tras el cambio de pila. Un usuario invitado sin privilegios de KVM podría usar este error para provocar el cierre inesperado del guest o escalar sus privilegios en el guest."
    }
  ],
  "lastModified": "2026-06-17T01:50:27.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A63F7D1D-EB47-48AE-B89E-E84A63579FA6"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.16:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01CC5953-3A04-4AA8-B8F9-18BFE5EF7FCE"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.17:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C5453A6-E8CE-411F-8B41-669F170FE6D8"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.17:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7126FD36-70E6-4BAA-A0A7-F2A1C380F99A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.17:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22D43572-4406-42D2-812F-79954D31CCC4"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C8D871B-AEA1-4407-AEE3-47EC782250FF"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98381E61-F082-4302-B51F-5648884F998B"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D99A687E-EAE6-417E-A88E-D0082BC194CD"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8442C20-41F9-47FD-9A12-E724D3A31FD7"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6755B6AD-0422-467B-8115-34A60B1D1A40"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24C0F4E1-C52C-41E0-9F14-F83ADD5CC7ED"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5F7E11E-FB34-4467-8919-2B6BEAABF665"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_virtualization:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DE8FF8A-4285-4D69-9F38-297457A117ED"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}