CVE-2018-8897
published 2018-05-08CVE-2018-8897: A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some…
PriorityP260high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
18.70%
96.9th percentile
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.
Affected
143 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| amd | amd_ryzen_5000_series_processors_with_radeon_graphics_barcelo | — | — |
| amd | amd_ryzen_6000_series_processors_with_radeon_graphics_rembrandt | — | — |
| amd | amd_ryzen_7030_series_mobile_processors_with_radeon_graphics_barcelo-r | — | — |
| amd | amd_ryzen_7035_series_processors_with_radeon_graphics_rembrandt-r | — | — |
| amd | ryzen_3_5100_firmware | < comboam4v2_1.2.0.b | comboam4v2_1.2.0.b |
| amd | ryzen_3_5125c_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_3_5300g_firmware | < comboam4v2_1.2.0.b | comboam4v2_1.2.0.b |
| amd | ryzen_3_5300ge_firmware | < comboam4v2_1.2.0.b | comboam4v2_1.2.0.b |
| amd | ryzen_3_5400u_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_3_5425u_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_3_7335u_firmware | < rembrandtpi-fp7_1.0.0.9 | rembrandtpi-fp7_1.0.0.9 |
| amd | ryzen_3_pro_7330u_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_3_pro_7440u_firmware | < phoenixpi-fp8-fp7_pi_1.0.0.1g | phoenixpi-fp8-fp7_pi_1.0.0.1g |
| amd | ryzen_5000_series_desktop_processor_with_radeon_graphics_cezanne | — | — |
| amd | ryzen_5000_series_mobile_processors_with_radeon_graphics_cezanne | — | — |
| amd | ryzen_5_5500_firmware | < comboam4v2_1.2.0.b | comboam4v2_1.2.0.b |
| amd | ryzen_5_5500h_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_5_5560u_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_5_5600g_firmware | < comboam4v2_1.2.0.b | comboam4v2_1.2.0.b |
| amd | ryzen_5_5600ge_firmware | < comboam4v2_1.2.0.b | comboam4v2_1.2.0.b |
| amd | ryzen_5_5600h_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_5_5600hs_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_5_5600u_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_5_5625u_firmware | < cezannepi-fp6_1.0.0.f | cezannepi-fp6_1.0.0.f |
| amd | ryzen_5_6600h_firmware | < rembrandtpi-fp7_1.0.0.9 | rembrandtpi-fp7_1.0.0.9 |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit requires an authenticated local session (meterpreter) on a 64-bit Windows target; detect unusual processes spawned from cmd.exe under a low-privileged user that result in kernel-mode code execution. ↗
- →The Metasploit module uploads a pre-compiled exploit binary (cve-2018-8897-exe.exe) and a payload EXE to %TEMP%; monitor for executable drops into the TEMP directory followed by cmd.exe execution of those binaries. ↗
- →The exploit targets Windows x64 only and explicitly fails against Windows XP; scope detection rules to 64-bit Windows systems. ↗
- →The vulnerability is triggered by MOV SS / POP SS followed by a CPL-transition instruction (e.g., SYSCALL, SYSENTER, INT 3); kernel-level debug exception (#DB) handling anomalies at CPL < 3 are the key behavioral indicator. ↗
- →KVA Shadowing (Kernel Virtual Address Shadowing) being disabled is a prerequisite for the PoC to succeed on Windows; check registry/system settings for KVA Shadowing status as a risk indicator. ↗
- →The exploit may not work under certain hypervisors (e.g., VMware) that discard the pending #DB after INT3; anomalous #DB exceptions in bare-metal or non-VMware environments should be treated with higher suspicion. ↗
- ·The Metasploit module uses randomly named exploit and payload binaries by default (%RAND%.exe), making static filename-based detection unreliable; behavioral detection (drop + execute in %TEMP%) is more robust. ↗
- ·The Windows update fully resolves the vulnerability without requiring microcode or hardware OEM updates; patched systems are not vulnerable regardless of hypervisor configuration. ↗
- ·This vulnerability is unrelated to speculative execution side-channel attacks; do not conflate detection/mitigation with Spectre/Meltdown controls. ↗
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_msrc7.0HIGH
vendor_ubuntu5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: error in exception handling leads to DoS (CVE-2018-8897 regression)
vendor_redhat·2018-07-10·CVSS 6.5
CVE-2018-10872 [MEDIUM] CWE-250 kernel: error in exception handling leads to DoS (CVE-2018-8897 regression)
kernel: error in exception handling leads to DoS (CVE-2018-8897 regression)
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in DoS. This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10 GA kernel. No other versions are affected by this CVE.
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switc
Apple
CVE-2018-8897: macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan
vendor_apple·2018-06-01·CVSS 7.8
CVE-2018-8897 [HIGH] CVE-2018-8897: macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan
Apple Security Update: About the security content of macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan
Product: macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan
CVE: CVE-2018-8897
Component: Kernel
Impact: A malicious application may be able to execute arbitrary code with kernel privileges
Description: In some circumstances, some operating systems may not expect or properly handle an Intel architecture debug exception after certain instructions. The issue appears to be from an undocumented side effect of the instructions. An attacker might utilize this exception handling to gain access to Ring 0 and access sensitive memory or control operating system processes.
Microsoft
Windows Kernel Elevation of Privilege Vulnerability
vendor_msrc·2018-05-08·CVSS 7.0
CVE-2018-8897 [HIGH] Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
FAQ: 1. Is there an expected performance impact associated with the update for this vulnerability?
No. There is no a
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-05-08·CVSS 5.5
CVE-2018-1000199 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3641-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS, Ubuntu 16.04 LTS, and Ubuntu 17.10. This update provides the
corresponding updates for Ubuntu 12.04 ESM.
Nick Peterson discovered that the Linux kernel did not properly handle
debug exceptions following a MOV/POP to SS instruction. A local attacker
could use this to cause a denial of service (system crash). This issue only
affected the amd64 architecture. (CVE-2018-8897)
Andy Lutomirski discovered that the KVM subsystem of the Linux kernel did
not properly emulate the ICEBP instruction following a MOV/POP to SS
instruction. A local attacker in a KVM virtual machine could use this to
cause a denial of service (gue
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-05-08·CVSS 5.5
CVE-2018-1000199 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Nick Peterson discovered that the Linux kernel did not
properly handle debug exceptions following a MOV/POP to SS
instruction. A local attacker could use this to cause a denial
of service (system crash). This issue only affected the amd64
architecture. (CVE-2018-8897)
Andy Lutomirski discovered that the KVM subsystem of the Linux kernel
did not properly emulate the ICEBP instruction following a MOV/POP
to SS instruction. A local attacker in a KVM virtual machine could
use this to cause a denial of service (guest VM crash) or possibly
escalate privileges inside of the virtual machine. This issue only
affected the i386 and amd64 architectures. (CVE-2018-1087)
Andy Lutomirski discovered th
BSD
FreeBSD-SA-18:06.debugreg: Mishandling of x86 debug exceptions
bsd_advisories·2018-05-08·CVSS 7.8
CVE-2018-8897 [HIGH] FreeBSD-SA-18:06.debugreg: Mishandling of x86 debug exceptions
FreeBSD-SA-18:06.debugreg Security Advisory
The FreeBSD Project
Topic: Mishandling of x86 debug exceptions
Category: core
Module: kernel
Announced: 2018-05-08
Credits: Nick Peterson, Everdox Tech LLC
https://www.linkedin.com/in/everdox
Andy Lutomirski
Affects: All supported versions of FreeBSD.
Corrected: 2018-05-08 17:03:33 UTC (stable/11, 11.2-PRERELEASE)
2018-05-08 17:12:10 UTC (releng/11.1, 11.1-RELEASE-p10)
2018-05-08 17:05:39 UTC (stable/10, 10.4-STABLE)
2018-05-08 17:12:10 UTC (releng/10.4, 10.4-RELEASE-p9)
CVE Name: CVE-2018-8897
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
On x86 architecture systems, the stack is represented by the combina
Red Hat
Kernel: error in exception handling leads to DoS
vendor_redhat·2018-05-08·CVSS 7.8
CVE-2018-8897 [HIGH] CWE-250 Kernel: error in exception handling leads to DoS
Kernel: error in exception handling leads to DoS
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) No
Apple
CVE-2018-8897: Security Update 2018-001
vendor_apple·2018-04-24·CVSS 7.8
CVE-2018-8897 [HIGH] CVE-2018-8897: Security Update 2018-001
Apple Security Update: About the security content of Security Update 2018-001
Product: Security Update 2018-001
CVE: CVE-2018-8897
Component: Kernel
Impact: A malicious application may be able to execute arbitrary code with kernel privileges
Description: In some circumstances, some operating systems may not expect or properly handle an Intel architecture debug exception after certain instructions. The issue appears to be from an undocumented side effect of the instructions. An attacker might utilize this exception handling to gain access to Ring 0 and access sensitive memory or control operating system processes.
Debian
CVE-2018-8897: linux - A statement in the System Programming Guide of the Intel 64 and IA-32 Architectu...
vendor_debian·2018·CVSS 7.8
CVE-2018-8897 [HIGH] CVE-2018-8897: linux - A statement in the System Programming Guide of the Intel 64 and IA-32 Architectu...
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the
Debian
CVE-2018-10872: linux - A flaw was found in the way the Linux kernel handled exceptions delivered after ...
vendor_debian·2018·CVSS 6.5
CVE-2018-10872 [MEDIUM] CVE-2018-10872: linux - A flaw was found in the way the Linux kernel handled exceptions delivered after ...
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in DoS. This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10 GA kernel. No other versions are affected by this CVE.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Citrix
Citrix Security Bulletin CTX234679
vendor_citrix·CVSS 7.8
CVE-2018-8897 [HIGH] Citrix Security Bulletin CTX234679
Citrix Security Bulletin CTX234679
CVE References: CVE-2018-8897, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
GHSA
GHSA-3x8j-5c5c-jh43: A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentially resul
ghsa_unreviewed·2023-11-14·CVSS 7.8
CVE-2023-20571 [HIGH] CWE-362 GHSA-3x8j-5c5c-jh43: A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentially resul
A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentially resulting in privilege escalation.
GHSA
GHSA-652g-78m6-29wq: A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions
ghsa_unreviewed·2022-05-13·CVSS 6.5
CVE-2018-10872 [MEDIUM] CWE-119 GHSA-652g-78m6-29wq: A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in DoS. This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10 GA kernel. No other versions are affected by this CVE.
GHSA
GHSA-j2cv-h77g-5p95: A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the developmen
ghsa_unreviewed·2022-05-13
CVE-2018-8897 [HIGH] CWE-362 GHSA-j2cv-h77g-5p95: A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the developmen
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the
OSV
CVE-2018-10872: A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions
osv·2018-07-10·CVSS 5.5
CVE-2018-10872 [MEDIUM] CVE-2018-10872: A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in DoS. This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10 GA kernel. No other versions are affected by this CVE.
OSV
CVE-2018-8897: A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the developmen
osv·2018-05-08·CVSS 7.8
CVE-2018-8897 [HIGH] CVE-2018-8897: A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the developmen
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the
OSV
linux, linux-aws, linux-azure, linux-euclid, linux-gcp, linux-hwe, linux-kvm, linux-lts-xenial, linux-oem, linux-raspi2, linux-snapdragon vulnerabilities
osv·2018-05-08·CVSS 5.5
CVE-2018-8897 [MEDIUM] linux, linux-aws, linux-azure, linux-euclid, linux-gcp, linux-hwe, linux-kvm, linux-lts-xenial, linux-oem, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-azure, linux-euclid, linux-gcp, linux-hwe, linux-kvm, linux-lts-xenial, linux-oem, linux-raspi2, linux-snapdragon vulnerabilities
Nick Peterson discovered that the Linux kernel did not
properly handle debug exceptions following a MOV/POP to SS
instruction. A local attacker could use this to cause a denial
of service (system crash). This issue only affected the amd64
architecture. (CVE-2018-8897)
Andy Lutomirski discovered that the KVM subsystem of the Linux kernel
did not properly emulate the ICEBP instruction following a MOV/POP
to SS instruction. A local attacker in a KVM virtual machine could
use this to cause a denial of service (guest VM crash) or possibly
escalate privileges inside of the virtual machine. This issue only
affected the i386 and amd64 architect
No detection rules found.
Exploit-DB
Microsoft Windows - POP/MOV SS Local Privilege Elevation (Metasploit)
exploitdb·2018-07-13·CVSS 7.8
CVE-2018-8897 [HIGH] Microsoft Windows - POP/MOV SS Local Privilege Elevation (Metasploit)
Microsoft Windows - POP/MOV SS Local Privilege Elevation (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core/post/common'
require 'msf/core/post/file'
require 'msf/core/post/windows/priv'
require 'msf/core/post/windows/registry'
require 'msf/core/exploit/exe'
class MetasploitModule 'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability',
'Description' => %q{
This module exploits a vulnerability in a statement in the system programming guide
of the Intel 64 and IA-32 architectures software developer's manual being mishandled
in various operating system kerneles, resulting in unexpected behavior for #DB
excpetions that are deferred by MOV SS or POP SS.
Exploit-DB
Microsoft Windows - 'POP/MOV SS' Privilege Escalation
exploitdb·2018-05-22·CVSS 7.8
CVE-2018-8897 [HIGH] Microsoft Windows - 'POP/MOV SS' Privilege Escalation
Microsoft Windows - 'POP/MOV SS' Privilege Escalation
---
Demo exploitation of the POP SS vulnerability (CVE-2018-8897), leading to unsigned code execution with kernel privilages.
- KVA Shadowing should be disabled and the relevant security update should be uninstalled.
- This may not work with certain hypervisors (like VMWare), which discard the pending #DB after INT3.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44697.zip
Metasploit
Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability
metasploit
Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability
Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability
This module exploits a vulnerability in a statement in the system programming guide of the Intel 64 and IA-32 architectures software developer's manual being mishandled in various operating system kerneles, resulting in unexpected behavior for #DB excpetions that are deferred by MOV SS or POP SS. This module will upload the pre-compiled exploit and use it to execute the final payload in order to gain remote code execution.
Qualys
What we’ve got here is failure to communicate: OS vendors misread CPU docs, create flaw
blogs_qualys·2018-05-14·CVSS 7.8
[HIGH] What we’ve got here is failure to communicate: OS vendors misread CPU docs, create flaw
In a memorable scene from “Jumpin’ Jack Flash,” Whoopi Goldberg struggles to understand the lyrics of the eponymous song from the Rolling Stones, as she pleads: “Mick, Mick, Mick, speak English!”
It appears that multiple operating system vendors had similar trouble interpreting Intel and AMD debugging documentation, which led the OS vendors to independently create the same critical security flaw in their respective kernel software.
The issue came to light last week when US-CERT (United States Computer Emergency Readiness Team) warned that under certain circumstances “some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception.”
“The error appears to be due to developer interpretation of existing documentation for certain Intel a
Qualys
What we’ve got here is failure to communicate: OS vendors misread CPU docs, create flaw | Qualys
blogs_qualys·2018-05-14·CVSS 7.8
[HIGH] What we’ve got here is failure to communicate: OS vendors misread CPU docs, create flaw | Qualys
In a memorable scene from “Jumpin’ Jack Flash,” Whoopi Goldberg struggles to understand the lyrics of the eponymous song from the Rolling Stones, as she pleads: “Mick, Mick, Mick, speak English!”
It appears that multiple operating system vendors had similar trouble interpreting Intel and AMD debugging documentation, which led the OS vendors to independently create the same critical security flaw in their respective kernel software.
The issue came to light last week when US-CERT (United States Computer Emergency Readiness Team) warned that under certain circumstances “some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception.”
“The error appears to be due to developer interpretation of existing documentation for certain Intel a
Talos
Microsoft Patch Tuesday - May 2018
blogs_talos·2018-05-08·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - May 2018
Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 67 new vulnerabilities, with 21 of them rated critical, 42 of them rated important, and four rated as low severity. These vulnerabilities impact Outlook, Office, Exchange, Edge, Internet Explorer and more.
In addition to the 67 vulnerabilities referenced above, Microsoft has also released a critical update advisory, ADV180008, which addresses the vulnerability CVE-2018-4944 described in the Adobe security bulletin APSB18-16.
### Critical Vulnerabilities
This month, Microsoft is addressing 21 vulnerabilities that are rated as critical. Talos believes one of these is notable and requires prompt attenti
Talos
Microsoft Patch Tuesday - May 2018
blogs_talos·2018-05-08·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - May 2018
## Microsoft Patch Tuesday - May 2018
Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 67 new vulnerabilities, with 21 of them rated critical, 42 of them rated important, and four rated as low severity. These vulnerabilities impact Outlook, Office, Exchange, Edge, Internet Explorer and more.
In addition to the 67 vulnerabilities referenced above, Microsoft has also released a critical update advisory, ADV180008 , which addresses the vulnerability CVE-2018-4944 described in the Adobe security bulletin APSB18-16 .
## Critical Vulnerabilities
This month, Microsoft is addressing 21 vulnerabilities that are rated as critical. Talos believes one of thes
Bugzilla
CVE-2018-10872 kernel: error in exception handling leads to DoS (CVE-2018-8897 regression)
bugzilla·2018-06-28·CVSS 6.5
CVE-2018-10872 [MEDIUM] CVE-2018-10872 kernel: error in exception handling leads to DoS (CVE-2018-8897 regression)
CVE-2018-10872 kernel: error in exception handling leads to DoS (CVE-2018-8897 regression)
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed.
An unprivileged system user could use this flaw to crash the system kernel resulting in DoS.
This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10. No other versions are affected by this CVE.
Upstream patch:
-> https://git.kernel.org/linus/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9
Reference:
-> http://www.openwall.com/lists/oss-security/2018/05/
Bugzilla
CVE-2018-8897 Kernel: error in exception handling leads to DoS
bugzilla·2018-04-13·CVSS 7.8
CVE-2018-8897 [HIGH] CVE-2018-8897 Kernel: error in exception handling leads to DoS
CVE-2018-8897 Kernel: error in exception handling leads to DoS
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed.
An unprivileged system user could use this flaw to crash the system kernel resulting in DoS.
Upstream patch:
-> https://git.kernel.org/linus/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9
Reference:
-> http://www.openwall.com/lists/oss-security/2018/05/08/4
Discussion:
Acknowledgments:
Name: Nick Peterson (Everdox Tech LLC), Andy Lutomirski
---
This issue was fixed for Fedora with the 4.16 rebases
---
Statement:
This
arXiv
From LLMs to Agents: A Comparative Evaluation of LLMs and LLM-based Agents in Security Patch Detection
arxiv_fulltext·2025-11-11
From LLMs to Agents: A Comparative Evaluation of LLMs and LLM-based Agents in Security Patch Detection
From LLMs to Agents: A Comparative Evaluation of LLMs and LLM-based Agents in Security Patch Detection
Junxiao Han, Zheng Yu, Lingfeng Bao, Jiakun Liu, Yao Wan, Jianwei Yin, Shuiguang Deng, and Song Han
Junxiao Han, Zheng Yu, and Song Han are with the School of Computer and Computing Science, Hangzhou City University, Hangzhou 310015, China. E-mail: [email protected], [email protected], and [email protected]
Lingfeng Bao is with the State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou 310027, China. E-mail: [email protected]
Jiakun Liu is with the Faculty of Computing, Harbin Institute of Technology, Harbin 150001, China. E-mail: [email protected]
Yao Wan is with the College of Computer Science and Technology, Huazhong University of Science and T
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9http://openwall.com/lists/oss-security/2018/05/08/1http://openwall.com/lists/oss-security/2018/05/08/4http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-enhttp://www.securityfocus.com/bid/104071http://www.securitytracker.com/id/1040744http://www.securitytracker.com/id/1040849http://www.securitytracker.com/id/1040861http://www.securitytracker.com/id/1040866http://www.securitytracker.com/id/1040882https://access.redhat.com/errata/RHSA-2018:1318https://access.redhat.com/errata/RHSA-2018:1319https://access.redhat.com/errata/RHSA-2018:1345https://access.redhat.com/errata/RHSA-2018:1346https://access.redhat.com/errata/RHSA-2018:1347https://access.redhat.com/errata/RHSA-2018:1348https://access.redhat.com/errata/RHSA-2018:1349https://access.redhat.com/errata/RHSA-2018:1350https://access.redhat.com/errata/RHSA-2018:1351https://access.redhat.com/errata/RHSA-2018:1352https://access.redhat.com/errata/RHSA-2018:1353https://access.redhat.com/errata/RHSA-2018:1354https://access.redhat.com/errata/RHSA-2018:1355https://access.redhat.com/errata/RHSA-2018:1524https://bugzilla.redhat.com/show_bug.cgi?id=1567074https://github.com/can1357/CVE-2018-8897/https://github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0https://lists.debian.org/debian-lts-announce/2018/05/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2018/06/msg00000.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00013.htmlhttps://patchwork.kernel.org/patch/10386677/https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897https://security.netapp.com/advisory/ntap-20180927-0002/https://support.apple.com/HT208742https://support.citrix.com/article/CTX234679https://svnweb.freebsd.org/base?view=revision&revision=333368https://usn.ubuntu.com/3641-1/https://usn.ubuntu.com/3641-2/https://www.debian.org/security/2018/dsa-4196https://www.debian.org/security/2018/dsa-4201https://www.exploit-db.com/exploits/44697/https://www.exploit-db.com/exploits/45024/https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.aschttps://www.kb.cert.org/vuls/id/631579https://www.synology.com/support/security/Synology_SA_18_21https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.htmlhttps://xenbits.xen.org/xsa/advisory-260.htmlhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9http://openwall.com/lists/oss-security/2018/05/08/1http://openwall.com/lists/oss-security/2018/05/08/4http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-enhttp://www.securityfocus.com/bid/104071http://www.securitytracker.com/id/1040744http://www.securitytracker.com/id/1040849http://www.securitytracker.com/id/1040861http://www.securitytracker.com/id/1040866http://www.securitytracker.com/id/1040882https://access.redhat.com/errata/RHSA-2018:1318https://access.redhat.com/errata/RHSA-2018:1319https://access.redhat.com/errata/RHSA-2018:1345https://access.redhat.com/errata/RHSA-2018:1346https://access.redhat.com/errata/RHSA-2018:1347https://access.redhat.com/errata/RHSA-2018:1348https://access.redhat.com/errata/RHSA-2018:1349https://access.redhat.com/errata/RHSA-2018:1350https://access.redhat.com/errata/RHSA-2018:1351https://access.redhat.com/errata/RHSA-2018:1352https://access.redhat.com/errata/RHSA-2018:1353https://access.redhat.com/errata/RHSA-2018:1354https://access.redhat.com/errata/RHSA-2018:1355https://access.redhat.com/errata/RHSA-2018:1524https://bugzilla.redhat.com/show_bug.cgi?id=1567074https://github.com/can1357/CVE-2018-8897/https://github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0https://lists.debian.org/debian-lts-announce/2018/05/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2018/06/msg00000.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00013.htmlhttps://patchwork.kernel.org/patch/10386677/https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897https://security.netapp.com/advisory/ntap-20180927-0002/https://support.apple.com/HT208742https://support.citrix.com/article/CTX234679https://svnweb.freebsd.org/base?view=revision&revision=333368https://usn.ubuntu.com/3641-1/https://usn.ubuntu.com/3641-2/https://www.debian.org/security/2018/dsa-4196https://www.debian.org/security/2018/dsa-4201https://www.exploit-db.com/exploits/44697/https://www.exploit-db.com/exploits/45024/https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.aschttps://www.kb.cert.org/vuls/id/631579https://www.synology.com/support/security/Synology_SA_18_21https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.htmlhttps://xenbits.xen.org/xsa/advisory-260.html
2018-05-08
Published