CVE-2018-8897: apple mac_os_x

Modified

AliasesALPINE-CVE-2018-8897RHSA-2018:1349RHSA-2018:1350+5 more

Published 08-05-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-8897 is a high (CVSS 7.8) vulnerability in apple mac_os_x. EPSS estimates a 18.48% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities. 4 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 13-07-2018)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.0 (NVD)

EPSS score

18.48%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits4github, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 84 · Related 62

DLA-1383-1 DLA-1392-1 DLA-1577-1 DSA-4196-1 DSA-4201-1 MGASA-2018-0249+78 more

Timeline

08-05-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.07.8v2.07.2

EPSS trend

Probability

18.48%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 18.48% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

4 found

githubUnverified
Cve 2018 8897
Maturity: poc
exploit-databaselocalwindowsVerified
Microsoft Windows - 'POP/MOV SS' Privilege Escalation
Maturity: weaponized
exploit-databaselocalwindowsVerified
Microsoft Windows - POP/MOV SS Local Privilege Elevation (Metasploit)
Maturity: weaponized

Show all 4 exploits

MetasploitremoteVerified
Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability
exploit/windows/local/mov_ss
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat28 products

enterprise_linux_server7.0
enterprise_linux_workstation7.0
enterprise_virtualization_manager3.0
kernel< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6 | < 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-abi-whitelists< 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6

kernel-debug< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6 | < 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-debug-debuginfo< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6 | < 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-debug-devel< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6 | < 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-debuginfo< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6 | < 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-debuginfo-common< 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-debuginfo-common-x86_64< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6
kernel-devel< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6 | < 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-doc< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6 | < 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-firmware< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6
kernel-headers< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6 | < 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-kdump< 0:2.6.18-431.el5
kernel-kdump-debuginfo< 0:2.6.18-431.el5
kernel-kdump-devel< 0:2.6.18-431.el5
kernel-PAE< 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-PAE-debuginfo< 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-PAE-devel< 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-xen< 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-xen-debuginfo< 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
kernel-xen-devel< 0:2.6.18-348.39.2.el5 | < 0:2.6.18-431.el5
perf< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6
perf-debuginfo< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6
python-perf< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6
python-perf-debuginfo< 0:2.6.32-358.88.2.el6 | < 0:2.6.32-431.89.2.el6 | < 0:2.6.32-504.68.2.el6

Show all 28

Ubuntu17 products

linux< 3.13.0-147.196 | < 4.4.0-124.148
linux-aws< 4.4.0-1019.19 | < 4.4.0-1057.66
linux-azure< 4.13.0-1016.19
linux-azure-fdeAll versions (No fix recorded)
linux-euclid< 4.4.0-9027.29

Show all 17

Debian3 products

linux< 4.15.17-1
xen< 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6
debian_linuxEOL7.0 | 8.0 | 9.0

Synology2 products

diskstation_manager5.2 | 6.0 | 6.1
skynasna

Alpine1 product

xen< 4.10.1-r1 | < 4.6.6-r5 | < 4.7.3-r9 | < 4.8.3-r1 | < 4.9.2-r2

Apple1 product

mac_os_x< 10.13.4

Canonical1 product

ubuntu_linuxEOL14.04 | 16.04 | 17.10

Citrix1 product

xenserver6.0.2 | 6.2.0 | 6.5 | 7.0 | 7.1 | 7.2 | 7.3 | 7.4

Freebsd1 product

freebsd≥ 11.0, < 11.1

Xen1 product

xenna

10 vendors · 56 products

References

65 links

github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9X Refsource MISCPatchThird Party Advisory
openwall.com/lists/oss-security/2018/05/08/4X Refsource MISCMailing ListThird Party Advisory
www.securitytracker.com/id/1040849VDB EntryX Refsource SECTRACKThird Party Advisory
www.securityfocus.com/bid/104071VDB EntryX Refsource BIDThird Party Advisory
access.redhat.com/errata/RHSA-2018:1350Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
support.citrix.com/article/CTX234679X Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2018:1347Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.exploit-db.com/exploits/44697/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2018/05/msg00015.htmlMailing ListX Refsource MLISTThird Party Advisory
www.securitytracker.com/id/1040866VDB EntryX Refsource SECTRACKThird Party Advisory

Show all 65 references

lists.debian.org/debian-lts-announce/2018/11/msg00013.htmlMailing ListX Refsource MLIST
lists.debian.org/debian-lts-announce/2018/06/msg00000.htmlMailing ListX Refsource MLISTThird Party Advisory
support.apple.com/HT208742X Refsource MISCThird Party Advisory
access.redhat.com/errata/RHSA-2018:1346Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2018:1348Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2018:1354Vendor AdvisoryX Refsource REDHATThird Party Advisory
svnweb.freebsd.org/base?view=revision&revision=333368X Refsource MISCThird Party Advisory
www.debian.org/security/2018/dsa-4196Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.ascX Refsource MISCThird Party Advisory
www.securitytracker.com/id/1040744VDB EntryX Refsource SECTRACKThird Party Advisory
www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.htmlX Refsource MISCThird Party Advisory
access.redhat.com/errata/RHSA-2018:1351Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
bugzilla.redhat.com/show_bug.cgi?id=1567074X Refsource MISCIssue TrackingThird Party AdvisoryREPORT
xenbits.xen.org/xsa/advisory-260.htmlX Refsource MISCPatchThird Party Advisory
access.redhat.com/errata/RHSA-2018:1319Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.debian.org/security/2018/dsa-4201Vendor AdvisoryX Refsource DEBIANThird Party Advisory
help.ecostruxureit.com/display/…X Refsource CONFIRM
access.redhat.com/errata/RHSA-2018:1355Vendor AdvisoryX Refsource REDHATThird Party Advisory
security.netapp.com/advisory/ntap-20180927-0002/X Refsource CONFIRM
access.redhat.com/errata/RHSA-2018:1345Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.exploit-db.com/exploits/45024/ExploitX Refsource EXPLOIT DB
access.redhat.com/errata/RHSA-2018:1349Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897X Refsource CONFIRMPatchThird Party AdvisoryVendor Advisory
access.redhat.com/errata/RHSA-2018:1352Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2018:1318Vendor AdvisoryX Refsource REDHATThird Party Advisory
git.kernel.org/cgit/…X Refsource MISCPatchThird Party Advisory
patchwork.kernel.org/patch/10386677/X Refsource MISCPatchThird Party Advisory
www.kb.cert.org/vuls/id/631579Third Party AdvisoryX Refsource CERT VNREPORT
github.com/can1357/CVE-2018-8897/X Refsource MISCExploitThird Party Advisory
access.redhat.com/errata/RHSA-2018:1524Vendor AdvisoryX Refsource REDHATThird Party Advisory
openwall.com/lists/oss-security/2018/05/08/1X Refsource MISCMailing ListThird Party Advisory
www.securitytracker.com/id/1040861VDB EntryX Refsource SECTRACKThird Party Advisory
access.redhat.com/errata/RHSA-2018:1353Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
usn.ubuntu.com/3641-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.synology.com/support/security/Synology_SA_18_21X Refsource CONFIRMThird Party Advisory
www.securitytracker.com/id/1040882VDB EntryX Refsource SECTRACKThird Party Advisory
usn.ubuntu.com/3641-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-enX Refsource CONFIRM
security.alpinelinux.org/vuln/CVE-2018-8897Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/security/vulnerabilities/pop_ssARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1349.jsonAdvisory
access.redhat.com/security/cve/CVE-2018-8897REPORT
www.cve.org/CVERecord?id=CVE-2018-8897AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2018-8897Advisory
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1350.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1351.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1352.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1353.jsonAdvisory
ubuntu.com/security/CVE-2018-8897REPORT
xenbits.xen.org/xsa/advisory-260.htmlREPORT
everdox.net/popss.pdfREPORT
ubuntu.com/security/notices/USN-3641-1Advisory
ubuntu.com/security/notices/USN-3641-2Advisory
security-tracker.debian.org/tracker/CVE-2018-8897Advisory