CVE-2018-1087

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.

• CWE-250

• http://www.openwall.com/lists/oss-security/2018/05/08/5Mailing List
• http://www.securityfocus.com/bid/104127Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040862Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1318Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1345Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1347Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1348Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1355Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1524Third Party Advisory
• https://access.redhat.com/security/vulnerabilities/pop_ssThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087Issue Tracking
• https://usn.ubuntu.com/3641-1/Third Party Advisory
• https://usn.ubuntu.com/3641-2/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4196Third Party Advisory
• http://www.openwall.com/lists/oss-security/2018/05/08/5Mailing List
• http://www.securityfocus.com/bid/104127Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040862Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1318Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1345Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1347Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1348Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1355Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1524Third Party Advisory
• https://access.redhat.com/security/vulnerabilities/pop_ssThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087Issue Tracking
• https://usn.ubuntu.com/3641-1/Third Party Advisory
• https://usn.ubuntu.com/3641-2/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4196Third Party Advisory

Published

May 15, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10864An uncontrolled resource consumption flaw has been discovere…5.3
• CVE-2018-10865It was discovered that the /configuration view of redhat-cer…7.5
• CVE-2018-10866It was discovered that the /configuration view of redhat-cer…9.1
• CVE-2018-10867Files are accessible without restrictions from the /update/r…9.1
• CVE-2018-10868redhat-certification 7 does not properly restrict the number…7.5
• CVE-2018-10869redhat-certification does not properly restrict files that c…7.5
• CVE-2018-10870redhat-certification does not properly sanitize paths in rhc…9.8
• CVE-2018-10871389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable …3.8
• CVE-2018-10872A flaw was found in the way the Linux kernel handled excepti…6.5
• CVE-2018-10873A vulnerability was discovered in SPICE before version 0.14.…8.3
• CVE-2018-10874In ansible it was found that inventory variables are loaded …7.8
• CVE-2018-10875A flaw was found in ansible. ansible.cfg is read from the cu…7.8