CVE-2018-10853 — kernel: kvm: guest userspace to guest kernel write

Back Back to CVE browser

HIGH

kernel: kvm: guest userspace to guest kernel write

Published Sep 11, 2018

7.8

HIGH

CVSS 3.0

EPSS 0.47%

Description

A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.

Affected products

Vendor Linux Product Kernel Default
n/a
- Version
  4.18
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

Kernel

n/a

Version	Status	Constraints
4.18	affected	-

Red Hat Enterprise Linux 7

kernel-0:3.10.0-1062.el7

Fixed · RHSA-2019:2029
Red Hat Enterprise Linux 7

kernel-rt-0:3.10.0-1062.rt56.1022.el7

Fixed · RHSA-2019:2043
Red Hat Enterprise Linux 7.4 Advanced Update Support

kernel-0:3.10.0-693.62.1.el7

Fixed · RHSA-2020:0103
Red Hat Enterprise Linux 7.4 Telco Extended Update Support

kernel-0:3.10.0-693.62.1.el7

Fixed · RHSA-2020:0103
Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions

kernel-0:3.10.0-693.62.1.el7

Fixed · RHSA-2020:0103
Red Hat Enterprise Linux 7.5 Extended Update Support

kernel-0:3.10.0-862.46.1.el7

Fixed · RHSA-2020:0036
Red Hat Enterprise Linux 7.6 Extended Update Support

kernel-0:3.10.0-957.43.1.el7

Fixed · RHSA-2020:0179
Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS

kernel-0:3.10.0-957.43.1.el7

Fixed · RHSA-2020:0179
Red Hat Enterprise Linux 5

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-alt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise MRG 2

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	kernel-0:3.10.0-1062.el7	Fixed	RHSA-2019:2029
Red Hat Enterprise Linux 7	kernel-rt-0:3.10.0-1062.rt56.1022.el7	Fixed	RHSA-2019:2043
Red Hat Enterprise Linux 7.4 Advanced Update Support	kernel-0:3.10.0-693.62.1.el7	Fixed	RHSA-2020:0103
Red Hat Enterprise Linux 7.4 Telco Extended Update Support	kernel-0:3.10.0-693.62.1.el7	Fixed	RHSA-2020:0103
Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions	kernel-0:3.10.0-693.62.1.el7	Fixed	RHSA-2020:0103
Red Hat Enterprise Linux 7.5 Extended Update Support	kernel-0:3.10.0-862.46.1.el7	Fixed	RHSA-2020:0036
Red Hat Enterprise Linux 7.6 Extended Update Support	kernel-0:3.10.0-957.43.1.el7	Fixed	RHSA-2020:0179
Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS	kernel-0:3.10.0-957.43.1.el7	Fixed	RHSA-2020:0179
Red Hat Enterprise Linux 5	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-alt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise MRG 2	kernel-rt	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

0.47% 0.00470

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00470

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (15 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.47% (0.00470)	38.33th	v5 (v2026.06.15)
Jun 15, 2026	0.47% (0.00474)	37.06th	v5 (v2026.06.15)
Mar 17, 2025	0.05% (0.00049)	12.29th	v4 (v2025.03.14)
Dec 12, 2024	0.06% (0.00064)	30.08th	v3 (v2023.03.01)
Jul 13, 2024	0.06% (0.00064)	28.46th	v3 (v2023.03.01)
Sep 5, 2023	0.06% (0.00064)	26.44th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00046)	14.04th	v3 (v2023.03.01)
Mar 6, 2023	1.55% (0.01547)	74.98th	v2 (v2022.01.01)
Feb 23, 2023	1.55% (0.01547)	74.94th	v2 (v2022.01.01)
Apr 1, 2022	1.55% (0.01547)	72.92th	v2 (v2022.01.01)
Feb 4, 2022	1.55% (0.01547)	51.82th	v2 (v2022.01.01)
Feb 3, 2022	3.28% (0.03281)	66.54th	v1
Jan 6, 2022	3.28% (0.03281)	66.22th	v1
Sep 1, 2021	3.28% (0.03281)	81.60th	v1
Apr 14, 2021	3.28% (0.03281)	0.00th	v1

Weaknesses (2)

CWE-250

Execution with Unnecessary Privileges

CWE-269

Improper Privilege Management

References (19)

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html
vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2029
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2043
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0036
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0103
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0179
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2018-10853
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1589890
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10853
x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=129a72a0d3c8e139a04512325384fe5ac119e74
x_refsource_CONFIRMPatchVendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c9fa24ca7c9c47605672916491f79e8ccacb9e6
x_refsource_CONFIRMPatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10853
https://usn.ubuntu.com/3777-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://usn.ubuntu.com/3777-2/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-10853
https://www.openwall.com/lists/oss-security/2018/09/02/1
x_refsource_MISCMailing ListPatchThird Party Advisory

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html		vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2029		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2043		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0036		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0103		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0179		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2018-10853		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1589890		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10853		x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=129a72a0d3c8e139a04512325384fe5ac119e74		x_refsource_CONFIRMPatchVendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c9fa24ca7c9c47605672916491f79e8ccacb9e6		x_refsource_CONFIRMPatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10853
https://usn.ubuntu.com/3777-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://usn.ubuntu.com/3777-2/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-10853
https://www.openwall.com/lists/oss-security/2018/09/02/1		x_refsource_MISCMailing ListPatchThird Party Advisory