Privilege escalation in macOS - CVE-2018-8897

Vulnerability identifier: #VU12450

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8897

CWE-ID: CWE-703

Exploitation vector: Local access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper implementation of Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) on multiple system kernels, which results in an unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS. A local user can execute arbitrary code with elevated privileges.

macOS
Amazon Linux AMI
Debian Linux
Microsoft Windows
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
FreeBSD
SUSE Linux
Fedora
Windows Server

MRG Realtime
kernel (Red Hat package)
kernel-rt (Red Hat package)
xen (Alpine package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
xen
Red Hat Virtualization Host
Red Hat Virtualization

Update to version 10.13.4.

kernel (Red Hat package) - addressed in versions 2.6.18-348.39.2.el5, 2.6.32-358.88.2.el6, 2.6.32-431.89.2.el6, 2.6.32-504.68.2.el6, 2.6.32-573.55.2.el6, 2.6.32-754.2.1.el6, 3.10.0-327.66.3.el7, 3.10.0-514.48.3.el7, 3.10.0-693.25.4.el7
kernel-rt (Red Hat package) - addressed in versions 3.10.0-693.25.4.rt56.613.el6rt, 3.10.0-862.2.3.rt56.806.el7
xen (Alpine package) - update to 4.6.6-r5
xen - addressed in versions 4.8.3-5.fc26, 4.9.2-3.fc27, 4.10.1-2.fc28

• Exploit #6367 - Microsoft Windows - 'POP/MOV SS' Privilege Escalation (June 17, 2021)
• Exploit #6345 - Microsoft Windows - POP/MOV SS Local Privilege Elevation (Metasploit) (June 17, 2021)
• Exploit #2146 - syscall_exploit_CVE-2018-8897 (Implements the POP/MOV SS (CVE-2018-8897) vulnerability by leveraging SYSCALL to perform a local privilege escalation (LPE).) (March 18, 2020)
• Exploit #1942 - pop-mov-ss-exploit (The exploitation for CVE-2018-8897) (March 18, 2020)
• Exploit #1616 - Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability (March 18, 2020)

• https://support.apple.com/en-us/HT208742

• Multiple vulnerabilities in Apple macOS Sierra
• Privilege escalation in Microsoft Windows
• Privilege escalation in FreeBSD kernel
• Debian update for linux
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for xen
• SUSE Linux update for xen
• SUSE Linux update for xen
• SUSE Linux update for xen
• SUSE Linux update for xen
• SUSE Linux update for xen
• OpenSUSE Linux update for xen
• Red Hat update for Linux Kernel
• Red Hat update for Linux Kernel
• Red Hat update for Linux Kernel
• Red Hat update for Linux Kernel
• Red Hat update for Linux Kernel
• Red Hat update for Linux Kernel
• Red Hat update for Linux Kernel
• Red Hat update for Linux Kernel
• Red Hat update for Linux Kernel
• Red Hat update for Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• Debian update for xen
• Red Hat update for ISC DHCP
• Amazon Linux AMI update for kernel
• Red Hat update for kernel
• Privilege escalation in xen (Alpine package)
• Fedora 28 update for xen
• Fedora 27 update for xen
• Fedora 26 update for xen