Kernel: error in exception handling leads to DoS
Published May 8, 2018
7.8
HIGHCVSS 3.0
EPSS 18.48%
Description
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.
Affected products
No data.
Configuration 1
- 7.0
- 8.0
- 9.0
Configuration 2
- 14.04
- 16.04
- 17.10
Configuration 3
- 7.0
- 7.0
- 3.0
Configuration 4
Configuration 5
- n/a
- 5.2
- 6.0
- 6.1
No data.
RHEV 3.X Hypervisor and Agents for RHEL-6
rhev-hypervisor7-0:7.3-20180521.1.el6ev
Fixed · RHSA-2018:1711
RHEV 3.X Hypervisor and Agents for RHEL-7 ELS
redhat-virtualization-host-0:3.6-20180521.0
Fixed · RHSA-2018:1710
RHEV 3.X Hypervisor and Agents for RHEL-7 ELS
rhev-hypervisor7-0:7.3-20180521.1.el7ev
Fixed · RHSA-2018:1711
Red Hat Enterprise Linux 5 Extended Lifecycle Support
kernel-0:2.6.18-431.el5
Fixed · RHSA-2018:1353
Red Hat Enterprise Linux 5.9 Long Life
kernel-0:2.6.18-348.39.2.el5
Fixed · RHSA-2018:1352
Red Hat Enterprise Linux 6
kernel-0:2.6.32-696.28.1.el6
Fixed · RHSA-2018:1319
Red Hat Enterprise Linux 6.4 Advanced Update Support
kernel-0:2.6.32-358.88.2.el6
Fixed · RHSA-2018:1349
Red Hat Enterprise Linux 6.5 Advanced Update Support
kernel-0:2.6.32-431.89.2.el6
Fixed · RHSA-2018:1350
Red Hat Enterprise Linux 6.6 Advanced Update Support
kernel-0:2.6.32-504.68.2.el6
Fixed · RHSA-2018:1351
Red Hat Enterprise Linux 6.6 Telco Extended Update Support
kernel-0:2.6.32-504.68.2.el6
Fixed · RHSA-2018:1351
Red Hat Enterprise Linux 6.7 Extended Update Support
kernel-0:2.6.32-573.55.2.el6
Fixed · RHSA-2018:1346
Red Hat Enterprise Linux 7
kernel-0:3.10.0-862.2.3.el7
Fixed · RHSA-2018:1318
Red Hat Enterprise Linux 7
kernel-rt-0:3.10.0-862.2.3.rt56.806.el7
Fixed · RHSA-2018:1355
Red Hat Enterprise Linux 7.2 Advanced Update Support
kernel-0:3.10.0-327.66.3.el7
Fixed · RHSA-2018:1347
Red Hat Enterprise Linux 7.2 Telco Extended Update Support
kernel-0:3.10.0-327.66.3.el7
Fixed · RHSA-2018:1347
Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions
kernel-0:3.10.0-327.66.3.el7
Fixed · RHSA-2018:1347
Red Hat Enterprise Linux 7.3 Extended Update Support
kernel-0:3.10.0-514.48.3.el7
Fixed · RHSA-2018:1348
Red Hat Enterprise Linux 7.4 Extended Update Support
kernel-0:3.10.0-693.25.4.el7
Fixed · RHSA-2018:1345
Red Hat Enterprise MRG 2
kernel-rt-1:3.10.0-693.25.4.rt56.613.el6rt
Fixed · RHSA-2018:1354
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
imgbased-0:1.0.16-0.1.el7ev
Fixed · RHSA-2018:1524
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
ovirt-node-ng-0:4.2.0-0.20170814.0.el7
Fixed · RHSA-2018:1524
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
redhat-release-virtualization-host-0:4.2-3.0.el7
Fixed · RHSA-2018:1524
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
redhat-virtualization-host-0:4.2-20180508.0
Fixed · RHSA-2018:1524
Red Hat Enterprise Linux 7
kernel-alt
Affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Virtualization 3
rhev-hypervisor-ng
Affected
Red Hat Virtualization 4
rhev-hypervisor-ng
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| RHEV 3.X Hypervisor and Agents for RHEL-6 | rhev-hypervisor7-0:7.3-20180521.1.el6ev | Fixed | RHSA-2018:1711 |
| RHEV 3.X Hypervisor and Agents for RHEL-7 ELS | redhat-virtualization-host-0:3.6-20180521.0 | Fixed | RHSA-2018:1710 |
| RHEV 3.X Hypervisor and Agents for RHEL-7 ELS | rhev-hypervisor7-0:7.3-20180521.1.el7ev | Fixed | RHSA-2018:1711 |
| Red Hat Enterprise Linux 5 Extended Lifecycle Support | kernel-0:2.6.18-431.el5 | Fixed | RHSA-2018:1353 |
| Red Hat Enterprise Linux 5.9 Long Life | kernel-0:2.6.18-348.39.2.el5 | Fixed | RHSA-2018:1352 |
| Red Hat Enterprise Linux 6 | kernel-0:2.6.32-696.28.1.el6 | Fixed | RHSA-2018:1319 |
| Red Hat Enterprise Linux 6.4 Advanced Update Support | kernel-0:2.6.32-358.88.2.el6 | Fixed | RHSA-2018:1349 |
| Red Hat Enterprise Linux 6.5 Advanced Update Support | kernel-0:2.6.32-431.89.2.el6 | Fixed | RHSA-2018:1350 |
| Red Hat Enterprise Linux 6.6 Advanced Update Support | kernel-0:2.6.32-504.68.2.el6 | Fixed | RHSA-2018:1351 |
| Red Hat Enterprise Linux 6.6 Telco Extended Update Support | kernel-0:2.6.32-504.68.2.el6 | Fixed | RHSA-2018:1351 |
| Red Hat Enterprise Linux 6.7 Extended Update Support | kernel-0:2.6.32-573.55.2.el6 | Fixed | RHSA-2018:1346 |
| Red Hat Enterprise Linux 7 | kernel-0:3.10.0-862.2.3.el7 | Fixed | RHSA-2018:1318 |
| Red Hat Enterprise Linux 7 | kernel-rt-0:3.10.0-862.2.3.rt56.806.el7 | Fixed | RHSA-2018:1355 |
| Red Hat Enterprise Linux 7.2 Advanced Update Support | kernel-0:3.10.0-327.66.3.el7 | Fixed | RHSA-2018:1347 |
| Red Hat Enterprise Linux 7.2 Telco Extended Update Support | kernel-0:3.10.0-327.66.3.el7 | Fixed | RHSA-2018:1347 |
| Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions | kernel-0:3.10.0-327.66.3.el7 | Fixed | RHSA-2018:1347 |
| Red Hat Enterprise Linux 7.3 Extended Update Support | kernel-0:3.10.0-514.48.3.el7 | Fixed | RHSA-2018:1348 |
| Red Hat Enterprise Linux 7.4 Extended Update Support | kernel-0:3.10.0-693.25.4.el7 | Fixed | RHSA-2018:1345 |
| Red Hat Enterprise MRG 2 | kernel-rt-1:3.10.0-693.25.4.rt56.613.el6rt | Fixed | RHSA-2018:1354 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | imgbased-0:1.0.16-0.1.el7ev | Fixed | RHSA-2018:1524 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | ovirt-node-ng-0:4.2.0-0.20170814.0.el7 | Fixed | RHSA-2018:1524 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | redhat-release-virtualization-host-0:4.2-3.0.el7 | Fixed | RHSA-2018:1524 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | redhat-virtualization-host-0:4.2-20180508.0 | Fixed | RHSA-2018:1524 |
| Red Hat Enterprise Linux 7 | kernel-alt | Affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Virtualization 3 | rhev-hypervisor-ng | Affected | n/a |
| Red Hat Virtualization 4 | rhev-hypervisor-ng | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2 may address this issue.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1 other source (Red Hat) ▾
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
AV:L/AC:L/Au:N/C:C/I:C/A:C
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (37 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 18.48% (0.18485) | 97.17th | v5 (v2026.06.15) |
| Sep 22, 2026 | 18.48% (0.18485) | 97.12th | v5 (v2026.06.15) |
| Sep 21, 2026 | 38.30% (0.38295) | 98.54th | v5 (v2026.06.15) |
| Sep 20, 2026 | 18.48% (0.18485) | 97.11th | v5 (v2026.06.15) |
| Sep 6, 2026 | 18.84% (0.18842) | 97.09th | v5 (v2026.06.15) |
| Sep 5, 2026 | 38.93% (0.38929) | 98.53th | v5 (v2026.06.15) |
| Aug 30, 2026 | 18.84% (0.18842) | 97.08th | v5 (v2026.06.15) |
| Aug 28, 2026 | 38.93% (0.38929) | 98.52th | v5 (v2026.06.15) |
| Aug 24, 2026 | 18.84% (0.18842) | 97.06th | v5 (v2026.06.15) |
| Aug 23, 2026 | 38.93% (0.38929) | 98.52th | v5 (v2026.06.15) |
| Jun 15, 2026 | 18.40% (0.18404) | 96.86th | v5 (v2026.06.15) |
| Dec 14, 2025 | 24.80% (0.24796) | 95.94th | v4 (v2025.03.14) |
| Nov 21, 2025 | 23.21% (0.23210) | 95.72th | v4 (v2025.03.14) |
| Nov 18, 2025 | 20.90% (0.20901) | 95.22th | v4 (v2025.03.14) |
| Nov 14, 2025 | 23.21% (0.23210) | 95.71th | v4 (v2025.03.14) |
| Nov 9, 2025 | 24.80% (0.24796) | 95.90th | v4 (v2025.03.14) |
| Sep 8, 2025 | 23.21% (0.23210) | 95.73th | v4 (v2025.03.14) |
| Aug 1, 2025 | 19.90% (0.19900) | 95.26th | v4 (v2025.03.14) |
| Jul 16, 2025 | 21.34% (0.21337) | 95.41th | v4 (v2025.03.14) |
| Jul 13, 2025 | 23.45% (0.23447) | 95.71th | v4 (v2025.03.14) |
| Jun 30, 2025 | 21.43% (0.21428) | 95.40th | v4 (v2025.03.14) |
| Jun 19, 2025 | 19.99% (0.19986) | 95.16th | v4 (v2025.03.14) |
| May 2, 2025 | 15.77% (0.15769) | 94.37th | v4 (v2025.03.14) |
| Mar 17, 2025 | 17.63% (0.17629) | 94.59th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.07% (0.00072) | 33.15th | v3 (v2023.03.01) |
| Jun 25, 2023 | 0.07% (0.00073) | 30.08th | v3 (v2023.03.01) |
| May 20, 2023 | 0.08% (0.00080) | 32.88th | v3 (v2023.03.01) |
| May 2, 2023 | 0.07% (0.00072) | 29.27th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.06% (0.00061) | 24.05th | v3 (v2023.03.01) |
| Mar 6, 2023 | 12.63% (0.12625) | 95.53th | v2 (v2022.01.01) |
| Apr 1, 2022 | 12.63% (0.12625) | 95.18th | v2 (v2022.01.01) |
| Feb 4, 2022 | 12.63% (0.12625) | 90.03th | v2 (v2022.01.01) |
| Feb 3, 2022 | 33.67% (0.33666) | 97.72th | v1 |
| Sep 16, 2021 | 33.67% (0.33666) | 98.76th | v1 |
| Sep 14, 2021 | 6.43% (0.06427) | 90.28th | v1 |
| Sep 1, 2021 | 33.67% (0.33666) | 98.76th | v1 |
| Apr 14, 2021 | 33.67% (0.33666) | 0.00th | v1 |
References (52)
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 x_refsource_MISCPatchThird Party Advisory
- http://openwall.com/lists/oss-security/2018/05/08/1 x_refsource_MISCMailing ListThird Party Advisory
- http://openwall.com/lists/oss-security/2018/05/08/4 x_refsource_MISCMailing ListThird Party Advisory
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-en x_refsource_CONFIRM
- http://www.securityfocus.com/bid/104071 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040744 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040849 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040861 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040866 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040882 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:1318 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1319 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1345 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1346 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1347 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1348 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1349 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1350 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1351 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1352 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1353 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1354 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1355 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1524 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2018-8897 Vendor Advisory
- https://access.redhat.com/security/vulnerabilities/pop_ss
- https://bugzilla.redhat.com/show_bug.cgi?id=1567074 x_refsource_MISCIssue TrackingThird Party Advisory
- https://github.com/can1357/CVE-2018-8897/ x_refsource_MISCExploitThird Party Advisory
- https://github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 x_refsource_MISCPatchThird Party Advisory
- https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 x_refsource_CONFIRM
- https://lists.debian.org/debian-lts-announce/2018/05/msg00015.html mailing-listx_refsource_MLISTThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html mailing-listx_refsource_MLISTThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00013.html mailing-listx_refsource_MLIST
- https://nvd.nist.gov/vuln/detail/CVE-2018-8897
- https://patchwork.kernel.org/patch/10386677/ x_refsource_MISCPatchThird Party Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897 x_refsource_CONFIRMPatchThird Party AdvisoryVendor Advisory
- https://security.netapp.com/advisory/ntap-20180927-0002/ x_refsource_CONFIRM
- https://support.apple.com/HT208742 x_refsource_MISCThird Party Advisory
- https://support.citrix.com/article/CTX234679 x_refsource_CONFIRMThird Party Advisory
- https://svnweb.freebsd.org/base?view=revision&revision=333368 x_refsource_MISCThird Party Advisory
- https://usn.ubuntu.com/3641-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3641-2/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-8897
- https://www.debian.org/security/2018/dsa-4196 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://www.debian.org/security/2018/dsa-4201 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://www.exploit-db.com/exploits/44697/ exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/45024/ exploitx_refsource_EXPLOIT-DB
- https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc x_refsource_MISCThird Party Advisory
- https://www.kb.cert.org/vuls/id/631579 third-party-advisoryx_refsource_CERT-VN
- https://www.synology.com/support/security/Synology_SA_18_21 x_refsource_CONFIRMThird Party Advisory
- https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html x_refsource_MISCThird Party Advisory
- https://xenbits.xen.org/xsa/advisory-260.html x_refsource_MISCPatchThird Party Advisory
Change history (0)
No recorded changes yet.