CVE-2018-10853

Aliases:UBUNTU-CVE-2018-10853DEBIAN-CVE-2018-10853
Advisory lineage Upstream: 0 Downstream: 55
Modified
Published: 11 Sept 2018, 14:00
Last modified:05 Aug 2024, 07:46

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
v3.0 (nvd)
EPSS Score
0.47% LOW
0% probability +0.44%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Sept 2018, 14:00
Published
Vulnerability first disclosed
05 Aug 2024, 07:46
Last Modified
Vulnerability information updated

Description

A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.

CVSS Metrics

  • v3.0•HIGH•Score: 7CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v3.0•HIGH•Score: 7.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 4.6AV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.47%• Percentile: 40%

Techniques & Countermeasures

  • CWE-250•Execution with Unnecessary Privileges

    The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

  • CWE-269•Improper Privilege Management

    The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Systems

  • canonical•ubuntu_linux

    16.04 | 18.04

  • debian•linux

    < 4.16.16-1 | < 4.16.16-1 | < 4.16.16-1 | < 4.16.16-1

  • ubuntu•linux

    all | < 4.4.0-133.159 | < 4.15.0-36.39

  • ubuntu•linux-aws

    < 4.4.0-1027.30 | < 4.4.0-1065.75 | < 4.15.0-1023.23

  • ubuntu•linux-azure

    < 4.15.0-1031.32~14.04.1 | < 4.15.0-1025.26~16.04.1 | < 4.15.0-1025.26

  • ubuntu•linux-azure-6.11

    all

  • ubuntu•linux-azure-fde

    all

  • ubuntu•linux-fips

    < 4.4.0-1008.10

  • ubuntu•linux-gcp

    < 4.15.0-1021.22~16.04.1 | < 4.15.0-1021.22

  • ubuntu•linux-gcp-6.11

    all

  • ubuntu•linux-gke

    all

  • ubuntu•linux-hwe

    < 4.15.0-36.39~16.04.1

  • ubuntu•linux-hwe-6.11

    all

  • ubuntu•linux-intel-iot-realtime

    all

  • ubuntu•linux-kvm

    < 4.4.0-1031.37 | < 4.15.0-1023.23

  • ubuntu•linux-lowlatency-hwe-6.11

    all

  • ubuntu•linux-lts-xenial

    < 4.4.0-133.159~14.04.1

  • ubuntu•linux-oem

    < 4.15.0-1021.24

  • ubuntu•linux-raspi-realtime

    all

  • ubuntu•linux-raspi2

    < 4.4.0-1094.102 | < 4.15.0-1024.26 | all

  • ubuntu•linux-realtime

    all

  • ubuntu•linux-riscv

    all | all

  • ubuntu•linux-snapdragon

    < 4.4.0-1098.103 | < 4.15.0-1053.57

  • debian•debian_linux

    8.0

  • linux•kernel

    4.18

  • linux•linux_kernel

    < 4.18

References (21)