Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2018-10872

Execution with Unnecessary Privileges

Published: Jul 10, 2018 | Modified: Nov 21, 2024
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
4.9 MEDIUM
AV:L/AC:L/Au:N/C:N/I:N/A:C
RedHat/V2
RedHat/V3
6.5 MODERATE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2018-10872
CWEhttps://cwe.mitre.org/data/definitions/250.html

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in DoS. This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10 GA kernel. No other versions are affected by this CVE.

Weakness

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Affected Software

NameVendorStart VersionEnd Version
Enterprise_linuxRedhat6.0 (including)6.0 (including)
Enterprise_linux_desktopRedhat6.0 (including)6.0 (including)
Enterprise_linux_serverRedhat6.0 (including)6.0 (including)
Enterprise_linux_workstationRedhat6.0 (including)6.0 (including)
Red Hat Enterprise Linux 6RedHatkernel-0:2.6.32-754.2.1.el6*
Linux-floUbuntutrusty*
Linux-floUbuntuxenial*
Linux-gkeUbuntuxenial*
Linux-goldfishUbuntutrusty*
Linux-goldfishUbuntuxenial*
Linux-grouperUbuntutrusty*
Linux-lts-utopicUbuntutrusty*
Linux-lts-vividUbuntutrusty*
Linux-lts-wilyUbuntutrusty*
Linux-maguroUbuntutrusty*
Linux-makoUbuntutrusty*
Linux-makoUbuntuxenial*
Linux-mantaUbuntutrusty*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use