ID

VAR-201805-0950

CVE

CVE-2018-8897

TITLE

Hardware debug exception documentation may result in unexpected behavior

DESCRIPTION

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code with elevated privileges. Intel Architecture (processor architecture) is a CPU specification developed by Intel Corporation for its processor. There are security vulnerabilities in the operating systems of multiple vendors. Systems from the following vendors are affected: Apple; DragonFly BSD Project; FreeBSD Project; Linux Kernel; Microsoft; Red Hat; SUSE Linux; Ubuntu; Vmware; Xen. 7) - noarch, x86_64 3. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Bug Fix(es): * The kernel-rt packages have been upgraded to the 3.10.0-862.2.3 source tree, which provides a number of bug fixes over the previous version. (BZ#1549768) 4. CVE-2018-10471 An error was discovered in the mitigations against Meltdown which could result in denial of service. CVE-2018-10472 Anthony Perard discovered that incorrect parsing of CDROM images can result in information disclosure. CVE-2018-10981 Jan Beulich discovered that malformed device models could result in denial of service. CVE-2018-10982 Roger Pau Monne discovered that incorrect handling of high precision event timers could result in denial of service and potentially privilege escalation. ========================================================================== Ubuntu Security Notice USN-3641-2 May 08, 2018 linux, linux-lts-trusty vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 ESM Summary: Several security issues were fixed in the Linux kernel. This update provides the corresponding updates for Ubuntu 12.04 ESM. Nick Peterson discovered that the Linux kernel did not properly handle debug exceptions following a MOV/POP to SS instruction. A local attacker could use this to cause a denial of service (system crash). This issue only affected the amd64 architecture. A local attacker in a KVM virtual machine could use this to cause a denial of service (guest VM crash) or possibly escalate privileges inside of the virtual machine. This issue only affected the i386 and amd64 architectures. (CVE-2018-1087) Andy Lutomirski discovered that the Linux kernel did not properly perform error handling on virtualized debug registers. (CVE-2018-1000199) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 ESM: linux-image-3.13.0-147-generic 3.13.0-147.196~precise1 linux-image-3.13.0-147-generic-lpae 3.13.0-147.196~precise1 linux-image-3.2.0-134-generic 3.2.0-134.180 linux-image-3.2.0-134-generic-pae 3.2.0-134.180 linux-image-3.2.0-134-highbank 3.2.0-134.180 linux-image-3.2.0-134-omap 3.2.0-134.180 linux-image-3.2.0-134-powerpc-smp 3.2.0-134.180 linux-image-3.2.0-134-powerpc64-smp 3.2.0-134.180 linux-image-3.2.0-134-virtual 3.2.0-134.180 linux-image-generic 3.2.0.134.149 linux-image-generic-lpae-lts-trusty 3.13.0.147.138 linux-image-generic-lts-trusty 3.13.0.147.138 linux-image-generic-pae 3.2.0.134.149 linux-image-highbank 3.2.0.134.149 linux-image-omap 3.2.0.134.149 linux-image-powerpc 3.2.0.134.149 linux-image-powerpc-smp 3.2.0.134.149 linux-image-powerpc64-smp 3.2.0.134.149 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2018:1346-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:1346 Issue date: 2018-05-08 CVE Names: CVE-2018-8897 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux HPC Node EUS (v. 6.7) - noarch, x86_64 Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) - x86_64 Red Hat Enterprise Linux Server EUS (v. 6.7) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 6.7) - i386, ppc64, s390x, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * hw: cpu: speculative execution permission faults handling (CVE-2017-5754) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Google Project Zero for reporting CVE-2017-5754 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897. Bug Fix(es): * The kernel build requirements have been updated to the GNU Compiler Collection (GCC) compiler version that has the support for Retpolines. The Retpolines mechanism is a software construct that leverages specific knowledge of the underlying hardware to mitigate the branch target injection, also known as Spectre variant 2 vulnerability described in CVE-2017-5715. (BZ#1554253) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1519781 - CVE-2017-5754 hw: cpu: speculative execution permission faults handling 1567074 - CVE-2018-8897 Kernel: error in exception handling leads to DoS 6. Package List: Red Hat Enterprise Linux HPC Node EUS (v. 6.7): Source: kernel-2.6.32-573.55.2.el6.src.rpm noarch: kernel-abi-whitelists-2.6.32-573.55.2.el6.noarch.rpm kernel-doc-2.6.32-573.55.2.el6.noarch.rpm kernel-firmware-2.6.32-573.55.2.el6.noarch.rpm x86_64: kernel-2.6.32-573.55.2.el6.x86_64.rpm kernel-debug-2.6.32-573.55.2.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-573.55.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm kernel-debug-devel-2.6.32-573.55.2.el6.i686.rpm kernel-debug-devel-2.6.32-573.55.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-573.55.2.el6.i686.rpm kernel-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-573.55.2.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-573.55.2.el6.x86_64.rpm kernel-devel-2.6.32-573.55.2.el6.x86_64.rpm kernel-headers-2.6.32-573.55.2.el6.x86_64.rpm perf-2.6.32-573.55.2.el6.x86_64.rpm perf-debuginfo-2.6.32-573.55.2.el6.i686.rpm perf-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.i686.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7): x86_64: kernel-debug-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-573.55.2.el6.x86_64.rpm perf-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm python-perf-2.6.32-573.55.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm Red Hat Enterprise Linux Server EUS (v. 6.7): Source: kernel-2.6.32-573.55.2.el6.src.rpm i386: kernel-2.6.32-573.55.2.el6.i686.rpm kernel-debug-2.6.32-573.55.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-573.55.2.el6.i686.rpm kernel-debug-devel-2.6.32-573.55.2.el6.i686.rpm kernel-debuginfo-2.6.32-573.55.2.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-573.55.2.el6.i686.rpm kernel-devel-2.6.32-573.55.2.el6.i686.rpm kernel-headers-2.6.32-573.55.2.el6.i686.rpm perf-2.6.32-573.55.2.el6.i686.rpm perf-debuginfo-2.6.32-573.55.2.el6.i686.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-573.55.2.el6.noarch.rpm kernel-doc-2.6.32-573.55.2.el6.noarch.rpm kernel-firmware-2.6.32-573.55.2.el6.noarch.rpm ppc64: kernel-2.6.32-573.55.2.el6.ppc64.rpm kernel-bootwrapper-2.6.32-573.55.2.el6.ppc64.rpm kernel-debug-2.6.32-573.55.2.el6.ppc64.rpm kernel-debug-debuginfo-2.6.32-573.55.2.el6.ppc64.rpm kernel-debug-devel-2.6.32-573.55.2.el6.ppc64.rpm kernel-debuginfo-2.6.32-573.55.2.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-573.55.2.el6.ppc64.rpm kernel-devel-2.6.32-573.55.2.el6.ppc64.rpm kernel-headers-2.6.32-573.55.2.el6.ppc64.rpm perf-2.6.32-573.55.2.el6.ppc64.rpm perf-debuginfo-2.6.32-573.55.2.el6.ppc64.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.ppc64.rpm s390x: kernel-2.6.32-573.55.2.el6.s390x.rpm kernel-debug-2.6.32-573.55.2.el6.s390x.rpm kernel-debug-debuginfo-2.6.32-573.55.2.el6.s390x.rpm kernel-debug-devel-2.6.32-573.55.2.el6.s390x.rpm kernel-debuginfo-2.6.32-573.55.2.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-573.55.2.el6.s390x.rpm kernel-devel-2.6.32-573.55.2.el6.s390x.rpm kernel-headers-2.6.32-573.55.2.el6.s390x.rpm kernel-kdump-2.6.32-573.55.2.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-573.55.2.el6.s390x.rpm kernel-kdump-devel-2.6.32-573.55.2.el6.s390x.rpm perf-2.6.32-573.55.2.el6.s390x.rpm perf-debuginfo-2.6.32-573.55.2.el6.s390x.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.s390x.rpm x86_64: kernel-2.6.32-573.55.2.el6.x86_64.rpm kernel-debug-2.6.32-573.55.2.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-573.55.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm kernel-debug-devel-2.6.32-573.55.2.el6.i686.rpm kernel-debug-devel-2.6.32-573.55.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-573.55.2.el6.i686.rpm kernel-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-573.55.2.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-573.55.2.el6.x86_64.rpm kernel-devel-2.6.32-573.55.2.el6.x86_64.rpm kernel-headers-2.6.32-573.55.2.el6.x86_64.rpm perf-2.6.32-573.55.2.el6.x86_64.rpm perf-debuginfo-2.6.32-573.55.2.el6.i686.rpm perf-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.i686.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional EUS (v. 6.7): i386: kernel-debug-debuginfo-2.6.32-573.55.2.el6.i686.rpm kernel-debuginfo-2.6.32-573.55.2.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-573.55.2.el6.i686.rpm perf-debuginfo-2.6.32-573.55.2.el6.i686.rpm python-perf-2.6.32-573.55.2.el6.i686.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.i686.rpm ppc64: kernel-debug-debuginfo-2.6.32-573.55.2.el6.ppc64.rpm kernel-debuginfo-2.6.32-573.55.2.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-573.55.2.el6.ppc64.rpm perf-debuginfo-2.6.32-573.55.2.el6.ppc64.rpm python-perf-2.6.32-573.55.2.el6.ppc64.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.ppc64.rpm s390x: kernel-debug-debuginfo-2.6.32-573.55.2.el6.s390x.rpm kernel-debuginfo-2.6.32-573.55.2.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-573.55.2.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-573.55.2.el6.s390x.rpm perf-debuginfo-2.6.32-573.55.2.el6.s390x.rpm python-perf-2.6.32-573.55.2.el6.s390x.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.s390x.rpm x86_64: kernel-debug-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-573.55.2.el6.x86_64.rpm perf-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm python-perf-2.6.32-573.55.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-573.55.2.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-8897 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/cve/CVE-2017-5754 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFa8g7oXlSAg2UNWIIRAndxAKCjJ6nGTifr5N0rmAwWKT7WceVyAQCdH82L J6aZnn57/d8D1n9wFnC2OOg= =YzSF -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 6.5) - x86_64 3. (BZ#1554256) 4. CVE-2018-1087 Andy Lutomirski discovered that the KVM implementation did not properly handle #DB exceptions while deferred by MOV SS/POP SS, allowing an unprivileged KVM guest user to crash the guest or potentially escalate their privileges. For the oldstable distribution (jessie), these problems have been fixed in version 3.16.56-1+deb8u1. This update includes various fixes for regressions from 3.16.56-1 as released in DSA-4187-1 (Cf. For the stable distribution (stretch), these problems have been fixed in version 4.9.88-1+deb9u1. The fix for CVE-2018-1108 applied in DSA-4188-1 is temporarily reverted due to various regression, cf. For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlryHFFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0SMQA/9HoJDt2OdyqqtfNUuWfP3sgGV1QVjIJnF39unKRdIaGw9m0RHQUu1G3rC cgxcYcpQ0h10Yy5KVh4APqt55K7aVWVQT6xB0yx2VddMEwwl3rp2r/eL7EtoOkQT zZW5JponzlEAjC9uGk7CouA7z/qFtd5awufFhAjMF5eL4ZQ6pG8wWEbae6DbU9nz c7F+okC4hL6yPuWVEWzTRUFK1W0hs2N+VQgHV/afZaMAAooeZJDJeq1Hn/PVYvwJ IHSOs01+kn0OUFHkVRA7kVdFAYUJlfhsDcXd9nB/lkxhc/HNI1g/dK76mRxjsiMo pJlkPbEmZlOtmNG7vogxEp72ab24j2CITIHiID7ftZH5R/I2CSxp2dIzRVKdmP6P tsfh/KcpUMNwwiPiGed1DMCjtsHOodBOkLtVsoHHJVMZg2xqfCrlqNRUn9o+0DcR gO7HBsWG9K1qvSBWuRtQLT8QP00P3dSdhHmfWyfN8eJxTot+WJuMF/o+jbF6GGrZ lPmzWqg4oL7jvQO8nlEkatjIFejEg0jmt+rCXyEbK8Uc9xjJk35GKIZne5X09BFe 36zY7HbMlPvLP/VHSb6fcPBpQo/HuG0/htAB1HpWS1fPrth1J76g2EmwFSG5Lo51 IRxTXP4UZuOL1sJHQ80220tThKs2dk1Yy77dKk8qQiQ2nC2JgNs= =CskH -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

Design Error

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2025-06-26T22:30:25.895000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE