A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10853.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"function_hash": "44507450281427551836745194337233385820",
"length": 312.0
},
"id": "CVE-2018-10853-04951912",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/emulate.c",
"function": "segmented_write_std"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"function_hash": "48293007828282663379225779740936852288",
"length": 519.0
},
"id": "CVE-2018-10853-36e4407b",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/x86.c",
"function": "handle_ud"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"function_hash": "175082905589116003835799193060153013032",
"length": 224.0
},
"id": "CVE-2018-10853-4728703b",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/x86.c",
"function": "emulator_write_std"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"line_hashes": [
"237106227107829007834663505296494779854",
"174187126641939509577717026115490096359",
"182833149815579490419288695922176896476",
"63145319224393056085372509559056311477",
"95443269580501422589848606473730295248",
"174415263676574840077101234858606088488",
"161248569150108399616005334258407450755",
"4711794334865033043256784067875132728",
"339509028205008557055723476574596061149",
"263486395064325577115977518479818024144",
"36391106592513991337511955243159141816",
"180448821709368434204460716864168251034",
"179944123051925997993808806135480946107",
"237812559012550254710078472271581206119",
"284673969493928972788372485486616876820",
"87602562533532043490796343988512745049",
"104655327152204270932097925415494168978",
"198172043133779504829660367710451247034",
"29756134666606467452960507351108852930",
"164272024959760786859490409300843540722"
],
"threshold": 0.9
},
"id": "CVE-2018-10853-56d62e3f",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/x86.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"line_hashes": [
"19499764267994185199245462429816179375",
"82089503315936856264734701913918177146",
"209812869739735040653576037067956035233",
"49398609971819439152591363563184996859",
"216689905810564807474866634421725811447",
"25449741600732367687266060472074077549",
"231472605717250057173156285173833410155",
"19031888254910062082691578325922037970",
"188988991773805810820243258710339594201",
"14606101715565214418587238741153070676",
"69156866480191110791726396895406122727",
"42777304656921351059086571652950117082"
],
"threshold": 0.9
},
"id": "CVE-2018-10853-57b9a537",
"deprecated": false,
"target": {
"file": "arch/x86/include/asm/kvm_emulate.h"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"function_hash": "184849564950139474846548192511767093887",
"length": 187.0
},
"id": "CVE-2018-10853-6f684f19",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/emulate.c",
"function": "linear_read_system"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"function_hash": "14322693554834938321001165744511063982",
"length": 188.0
},
"id": "CVE-2018-10853-958819cd",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/emulate.c",
"function": "linear_write_system"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"function_hash": "127751464559110769913165755397694541406",
"length": 312.0
},
"id": "CVE-2018-10853-97e6d23b",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/emulate.c",
"function": "segmented_read_std"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"function_hash": "179676784318194359986450015434917808034",
"length": 955.0
},
"id": "CVE-2018-10853-b7894e90",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/emulate.c",
"function": "emulator_io_port_access_allowed"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"line_hashes": [
"206403156134447336850913591095176536044",
"211473439821225804371119942922119155410",
"283499856481430378282642498466138988020",
"204887231407540942040360746432608844303",
"33053007155092990971453407914254401112",
"208700665270843468780399828835965565091",
"236439131596966987742852058865020170222",
"320196608229947606973898763781407415988",
"261812561063927197791588387263422667256",
"118012362690540873853194498564674098773",
"306810892133299810385004492439802560683",
"227505052851987278996755257202912874553",
"295173337812737157691112332456260147031",
"22424967092644352979204979088472947064",
"309143346740701139908159526754181597648",
"312576497723631504967843119035683476195",
"82224417998919552269741468844814407064",
"274348472869259657180490759424870277613",
"146869757080593089457301616056903836274",
"331255253625457050188440829918890015777",
"281407091198314566072589364119745691724",
"20555976616508359801961719909582266065",
"189019692398526805172096701893217626787",
"3916822002445082903245996284646474731",
"254704708116744934956762446275729420279",
"223603575592138179131473932668021349547",
"331141801939106427075755726035275095207"
],
"threshold": 0.9
},
"id": "CVE-2018-10853-eecdb011",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/emulate.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3c9fa24ca7c9c47605672916491f79e8ccacb9e6",
"digest": {
"function_hash": "318373645929421798634250425331196713329",
"length": 209.0
},
"id": "CVE-2018-10853-f85f03d2",
"deprecated": false,
"target": {
"file": "arch/x86/kvm/x86.c",
"function": "emulator_read_std"
}
}
]