Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2020-00048

Опубликовано: 08 мая 2018
Источник: fstec
CVSS3: 7.8
CVSS2: 6.8
EPSS Средний

Описание

Уязвимость ядра операционных систем Linux, Windows, Ubuntu, Debian GNU/Linux, Red Hat Enterprise Linux, macOS, EulerOS связана с ошибками при интерпретации описания поведения инструкций MOV SS/POP SS. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии

Вендор

Microsoft Corp.
Canonical Ltd.
Red Hat Inc.
Сообщество свободного программного обеспечения
Apple Inc.
Huawei Technologies Co., Ltd.
АО «НТЦ ИТ РОСА»

Наименование ПО

Windows
Ubuntu
Red Hat Enterprise Linux
Debian GNU/Linux
Red Hat Virtualization
Red Hat Enterprise MRG
Mac OS
EulerOS
FusionModule1000A
FusionSphere OpenStack
ManageOne
OceanStor Backup Software
SMC2.0
iManager NetEco
iManager NetEco 6000
РОСА Кобальт

Версия ПО

Server 2008 R2 SP1 (Windows)
7 SP1 (Windows)
Server 2008 SP2 (Windows)
7 SP1 (Windows)
8.1 (Windows)
8.1 (Windows)
Server 2008 SP2 (Windows)
Server 2012 (Windows)
Server 2012 R2 (Windows)
14.04 LTS (Ubuntu)
8.1 RT (Windows)
10 (Windows)
10 (Windows)
10 1607 (Windows)
10 1607 (Windows)
6 (Red Hat Enterprise Linux)
7 (Red Hat Enterprise Linux)
16.04 LTS (Ubuntu)
10 1703 (Windows)
Server 2016 (Windows)
10 1703 (Windows)
Server 2008 SP2 Server Core installation (Windows)
Server 2008 SP2 Server Core installation (Windows)
Server 2012 R2 Server Core installation (Windows)
Server 2016 Server Core installation (Windows)
Server 2008 R2 SP1 (Windows)
9 (Debian GNU/Linux)
Server 2008 R2 SP1 Server Core installation (Windows)
Server 2012 Server Core installation (Windows)
Server 2008 SP2 (Windows)
10 1709 (Windows)
10 1709 (Windows)
17.10 (Ubuntu)
Server 1709 Server Core Installation (Windows)
10 1803 (Windows)
10 1803 (Windows)
Server 1803 Server Core Installation (Windows)
8.0 (Debian GNU/Linux)
4 (Red Hat Virtualization)
12.04 ESM (Ubuntu)
2.0 (Red Hat Enterprise MRG)
7.4 Extended Update Support (Red Hat Enterprise Linux)
7.0 (Debian GNU/Linux)
7.2 Advanced Update Support (Red Hat Enterprise Linux)
7.2 Telco Extended Update Support (Red Hat Enterprise Linux)
5 Extended Lifecycle Support (Red Hat Enterprise Linux)
5.9 Long Life (Red Hat Enterprise Linux)
7.3 Extended Update Support (Red Hat Enterprise Linux)
6.5 Advanced Update Support (Red Hat Enterprise Linux)
6.6 Advanced Update Support (Red Hat Enterprise Linux)
6.6 Telco Extended Update Support (Red Hat Enterprise Linux)
6.4 Advanced Update Support (Red Hat Enterprise Linux)
7.2 Update Services for SAP Solutions (Red Hat Enterprise Linux)
6.7 Extended Update Support (Red Hat Enterprise Linux)
до High Sierra 10.13.4 (Mac OS)
V200R002C10 (EulerOS)
V200R002C20 (EulerOS)
V200R003C00 (EulerOS)
V200R005C00 (EulerOS)
V100R003C10 (FusionModule1000A)
V100R005C00 (FusionSphere OpenStack)
V100R005C10 (FusionSphere OpenStack)
V100R006C00 (FusionSphere OpenStack)
V100R006C10 (FusionSphere OpenStack)
V100R006C30 (FusionSphere OpenStack)
V100R003C00 (ManageOne)
V100R006C30 (ManageOne)
V100R001C00 (OceanStor Backup Software)
V100R002C00 (OceanStor Backup Software)
V200R001C00 (OceanStor Backup Software)
V100R003C10 (SMC2.0)
V500R002C00 (SMC2.0)
V600R007C00 (iManager NetEco)
V600R007C10 (iManager NetEco)
V600R007C11 (iManager NetEco)
V600R007C12 (iManager NetEco)
V600R007C20 (iManager NetEco)
V600R007C40 (iManager NetEco)
V600R007C40 (iManager NetEco 6000)
V600R007C60 (iManager NetEco 6000)
V600R007C80 (iManager NetEco 6000)
V600R007C90 (iManager NetEco 6000)
- (РОСА Кобальт)

Тип ПО

Операционная система
ПО виртуализации/ПО виртуального программно-аппаратного средства
Прикладное ПО информационных систем
ПО программно-аппаратного средства АСУ ТП
ПО сетевого программно-аппаратного средства

Операционные системы и аппаратные платформы

Microsoft Corp. Windows Server 2008 R2 SP1
Microsoft Corp. Windows 7 SP1
Microsoft Corp. Windows Server 2008 SP2
Microsoft Corp. Windows 7 SP1
Microsoft Corp. Windows 8.1
Microsoft Corp. Windows 8.1
Microsoft Corp. Windows Server 2008 SP2
Microsoft Corp. Windows Server 2012
Microsoft Corp. Windows Server 2012 R2
Canonical Ltd. Ubuntu 14.04 LTS
Microsoft Corp. Windows 8.1 RT
Microsoft Corp. Windows 10
Microsoft Corp. Windows 10
Microsoft Corp. Windows 10 1607
Microsoft Corp. Windows 10 1607
Red Hat Inc. Red Hat Enterprise Linux 6
Red Hat Inc. Red Hat Enterprise Linux 7
Canonical Ltd. Ubuntu 16.04 LTS
Microsoft Corp. Windows 10 1703
Microsoft Corp. Windows Server 2016
Microsoft Corp. Windows 10 1703
Microsoft Corp. Windows Server 2008 SP2 Server Core installation
Microsoft Corp. Windows Server 2008 SP2 Server Core installation
Microsoft Corp. Windows Server 2012 R2 Server Core installation
Microsoft Corp. Windows Server 2016 Server Core installation
Microsoft Corp. Windows Server 2008 R2 SP1
Сообщество свободного программного обеспечения Debian GNU/Linux 9
Microsoft Corp. Windows Server 2008 R2 SP1 Server Core installation
Microsoft Corp. Windows Server 2012 Server Core installation
Microsoft Corp. Windows Server 2008 SP2
Microsoft Corp. Windows 10 1709
Microsoft Corp. Windows 10 1709
Canonical Ltd. Ubuntu 17.10
Microsoft Corp. Windows Server 1709 Server Core Installation
Microsoft Corp. Windows 10 1803
Microsoft Corp. Windows 10 1803
Microsoft Corp. Windows Server 1803 Server Core Installation
Сообщество свободного программного обеспечения Debian GNU/Linux 8.0
Canonical Ltd. Ubuntu 12.04 ESM
Red Hat Inc. Red Hat Enterprise Linux 7.4 Extended Update Support
Сообщество свободного программного обеспечения Debian GNU/Linux 7.0
Red Hat Inc. Red Hat Enterprise Linux 7.2 Advanced Update Support
Red Hat Inc. Red Hat Enterprise Linux 7.2 Telco Extended Update Support
Red Hat Inc. Red Hat Enterprise Linux 5 Extended Lifecycle Support
Red Hat Inc. Red Hat Enterprise Linux 5.9 Long Life
Red Hat Inc. Red Hat Enterprise Linux 7.3 Extended Update Support
Red Hat Inc. Red Hat Enterprise Linux 6.5 Advanced Update Support
Red Hat Inc. Red Hat Enterprise Linux 6.6 Advanced Update Support
Red Hat Inc. Red Hat Enterprise Linux 6.6 Telco Extended Update Support
Red Hat Inc. Red Hat Enterprise Linux 6.4 Advanced Update Support
Red Hat Inc. Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions
Red Hat Inc. Red Hat Enterprise Linux 6.7 Extended Update Support
Apple Inc. Mac OS до High Sierra 10.13.4
Huawei Technologies Co., Ltd. EulerOS V200R002C10
Huawei Technologies Co., Ltd. EulerOS V200R002C20
Huawei Technologies Co., Ltd. EulerOS V200R003C00
Huawei Technologies Co., Ltd. EulerOS V200R005C00
АО «НТЦ ИТ РОСА» РОСА Кобальт -

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6,8)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для программных продуктов Microsoft Corp.:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897
Для Ubuntu:
https://usn.ubuntu.com/3641-1/
https://usn.ubuntu.com/3641-2/
Для Debian GNU/Linux:
https://www.debian.org/security/2018/dsa-4196
https://www.debian.org/security/2018/dsa-4201
https://lists.debian.org/debian-lts-announce/2018/05/msg00015.html
https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html
https://lists.debian.org/debian-lts-announce/2018/11/msg00013.html
Для программных продуктов Red Hat Inc.:
https://bugzilla.redhat.com/show_bug.cgi?id=1567074
https://bugzilla.redhat.com/show_bug.cgi?id=1596094
Для программных продуктов Huawei Technologies Co., Ltd.:
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-en
Для Mac OS:
https://support.apple.com/ru-ru/HT208742
Для ОС РОСА КОБАЛЬТ:
http://wiki.rosalab.ru/ru/index.php/ROSA-SA-18-05-22.018

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 95%
0.19986
Средний

7.8 High

CVSS3

6.8 Medium

CVSS2

Связанные уязвимости

CVSS3: 7.8
ubuntu
около 7 лет назад

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that t...

CVSS3: 6.5
redhat
около 7 лет назад

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that t...

CVSS3: 7.8
nvd
около 7 лет назад

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that tran

CVSS3: 7
msrc
около 7 лет назад

Windows Kernel Elevation of Privilege Vulnerability

CVSS3: 7.8
debian
около 7 лет назад

A statement in the System Programming Guide of the Intel 64 and IA-32 ...

EPSS

Процентиль: 95%
0.19986
Средний

7.8 High

CVSS3

6.8 Medium

CVSS2