Overview
In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. The error appears to be due to developer interpretation of existing documentation for certain Intel architecture interrupt/exception instructions, namely MOV SS and POP SS.
Description
CWE-703: Improper Check or Handling of Exceptional Conditions - CVE-2018-8897 The MOV SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV SS or POP SS instruction itself). Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol 3A; section 2.3). |
Impact
An authenticated attacker may be able to read sensitive data in memory or control low-level operating system functions, |
Solution
Apply an update |
Vendor Information
Apple Affected
Notified: May 01, 2018 Updated: May 08, 2018
Statement Date: May 08, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
Apple has released a Security Update 2018-001 to address this issue.
Vendor References
Check Point Software Technologies Affected
Notified: May 01, 2018 Updated: May 10, 2018
Statement Date: May 10, 2018
Status
Affected
Vendor Statement
Check Point sees these as non-exploitable, taking our business logic and best practices into consideration.
See details at SecureKnowledge sk126534.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Vendor References
DragonFly BSD Project Affected
Notified: May 01, 2018 Updated: May 01, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
FreeBSD Project Affected
Notified: April 30, 2018 Updated: May 07, 2018
Statement Date: May 07, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
More information is available in the FreeBSD Security Advisory 18:06.
Vendor References
Linux Kernel Affected
Updated: May 08, 2018
Statement Date: May 08, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The issue was fixed upstream on March 23, with Linux "stable" branches was fixed shortly thereafter. Therefore the following kernels (or higher) contain the patch: 4.15.14, 4.14.31, 4.9.91, 4.4.125. The older 4.1, 3.16, and 3.2 branches are also affected.
Microsoft Affected
Notified: May 01, 2018 Updated: May 01, 2018
Statement Date: May 01, 2018
Status
Affected
Vendor Statement
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Vendor References
Red Hat, Inc. Affected
Notified: May 01, 2018 Updated: May 08, 2018
Statement Date: May 08, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
Red Hat Enterprise Linux is affected. Please see the security advisory for more information.
Vendor References
Ubuntu Affected
Notified: May 01, 2018 Updated: May 01, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Ubuntu Affected
Notified: May 01, 2018 Updated: May 08, 2018
Statement Date: May 08, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
Please see Ubuntu Security Notices USN-3641-1 and USN-3641-2 for more details.
Vendor References
VMware Affected
Notified: May 01, 2018 Updated: May 07, 2018
Statement Date: May 07, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
VMware has issued a statement about this vulnerability report. Please see the statement for full details.
Vendor References
Xen Affected
Notified: May 01, 2018 Updated: May 01, 2018
Statement Date: May 01, 2018
Status
Affected
Vendor Statement
All versions of Xen are vulnerable. Only x86 systems are vulnerable. ARM systems are not vulnerable.
Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability.
An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability, but such permissions are typically available to unprivileged users.
MITIGATION
==========
Running only HVM or PVH guests avoids the vulnerability.
Note however that a compromised device model (running in dom0 or a stub domain) can carry out this attack, so users with HVM domains are also advised to patch their systems.
RESOLUTION
==========
Applying the appropriate attached patch resolves this issue.
Vendor Information
For the full statement, please see Xen Advisory 260.
Vendor References
Brocade Communication Systems Not Affected
Notified: May 01, 2018 Updated: May 30, 2018
Statement Date: May 27, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Intel Not Affected
Notified: May 01, 2018 Updated: May 09, 2018
Statement Date: May 05, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
At this time, we are not aware of any Intel Products affected by CVE-2018-8897.
Vendor References
Joyent Not Affected
Notified: May 01, 2018 Updated: May 01, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
SmartOS does not allow access to the debug register outside of debug mode and so is not affected.
NetBSD Not Affected
Notified: May 01, 2018 Updated: May 01, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
NetBSD does not support debug register and so is not affected.
OpenBSD Not Affected
Notified: May 01, 2018 Updated: May 08, 2018
Statement Date: May 08, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
QUALCOMM Incorporated Not Affected
Notified: May 01, 2018 Updated: June 06, 2018
Statement Date: June 05, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ZyXEL Not Affected
Notified: May 01, 2018 Updated: May 21, 2018
Statement Date: May 14, 2018
Status
Not Affected
Vendor Statement
No Zyxel products are vulnerable to unexpected operating system behavior resulting from an Intel architecture hardware debug exception, as reported in [CERT/CC] vulnerability note VU#631579 at https://www.kb.cert.org/vuls/id/631579.
Vendor Information
Zyxel has issued Zyxel-SA-1135-01 stating that no products are affected.
eero Not Affected
Notified: May 01, 2018 Updated: May 08, 2018
Statement Date: May 08, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
3com Inc Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ACCESS Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ADTRAN Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ARRIS Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ASP Linux Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
AT&T Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
AVM GmbH Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Actiontec Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
AirWatch Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Alcatel-Lucent Enterprise Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Android Open Source Project Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Appgate Network Security Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Arch Linux Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Arista Networks, Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Aruba Networks Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
AsusTek Computer Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Avaya, Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Belkin, Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
BlackBerry Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
BlueCat Networks, Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Broadcom Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
CA Technologies Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Cambium Networks Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Cisco Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Command Software Systems Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
CoreOS Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
D-Link Systems, Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Debian GNU/Linux Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Dell Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Dell EMC Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
DesktopBSD Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Deutsche Telekom Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Devicescape Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Digi International Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
EfficientIP SAS Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Espressif Systems Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Extreme Networks Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
F-Secure Corporation Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Fedora Project Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Force10 Networks Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
GNU glibc Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Geexbox Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Gentoo Linux Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Google Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
HTC Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
HardenedBSD Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Hitachi Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Honeywell Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Huawei Technologies Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor References
IBM Corporation (zseries) Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
IBM eServer Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
IBM, INC. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
InfoExpress, Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Internet Systems Consortium Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Internet Systems Consortium - DHCP Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Interniche Technologies, inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Juniper Networks Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Lancope Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Lantronix Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Lenovo Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Linksys Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Marvell Semiconductors Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
MediaTek Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
MetaSwitch Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Micro Focus Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Microchip Technology Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
MikroTik Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Mitel Networks, Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
NETSCOUT Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Netgear, Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Nokia Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Nominum Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
OmniTI Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
OpenConnect Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
OpenDNS Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Openwall GNU/*/Linux Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Oracle Corporation Unknown
Notified: May 01, 2018 Updated: May 07, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
Oracle Solaris is not affected by CVE-2018-8897.
Peplink Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Philips Electronics Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
PowerDNS Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
QLogic Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
QNX Software Systems Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Quagga Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Quantenna Communications Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Ruckus Wireless Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
SafeNet Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Samsung Mobile Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Secure64 Software Corporation Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Sierra Wireless Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Slackware Linux Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Snort Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Symantec Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
TP-LINK Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
TippingPoint Technologies Inc. Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
TrueOS Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Ubiquiti Networks Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Unisys Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Wind River Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Zebra Technologies Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
aep NETWORKS Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
dnsmasq Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
eCosCentric Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
m0n0wall Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
netsnmp Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
pfSENSE Unknown
Notified: May 01, 2018 Updated: April 30, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| Temporal | 5.3 | E:POC/RL:OF/RC:C |
| Environmental | 5.3 | CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Microsoft and Intel credit Nick Peterson of Everdox Tech, LLC, for responsibly reporting this vulnerability and working with the group on coordinated disclosure. Andy Lutomirski is also credited for assistance in documenting the vulnerability for Linux.
This document was written by Garret Wassermann.
Other Information
| CVE IDs: | CVE-2018-8897 |
| Date Public: | 2018-05-08 |
| Date First Published: | 2018-05-08 |
| Date Last Updated: | 2019-07-11 16:31 UTC |
| Document Revision: | 107 |