Vulnerability Report

CVE-2018-8897

Title: Synology Skynas Auth Bypass

Auth Bypass

Proof Of Concept

PoC Available for CVE-2018-8897

CWE Category CWE-362

Published Date May 08, 2018

Modified Date Jun 17, 2026

Exploit Status Available

Score 7.8 CVSS v3.0

Exploit Probability (EPSS)

18.84%

Vulnerability Summary

CVE-2018-8897: A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.

Impacted Vendors

synology 1

citrix 1

Reference Links

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 http://openwall.com/lists/oss-security/2018/05/08/1 http://openwall.com/lists/oss-security/2018/05/08/4 http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-en http://www.securityfocus.com/bid/104071 http://www.securitytracker.com/id/1040744 http://www.securitytracker.com/id/1040849 http://www.securitytracker.com/id/1040861 http://www.securitytracker.com/id/1040866 http://www.securitytracker.com/id/1040882 https://access.redhat.com/errata/RHSA-2018:1318 https://access.redhat.com/errata/RHSA-2018:1319 https://access.redhat.com/errata/RHSA-2018:1345 https://access.redhat.com/errata/RHSA-2018:1346 https://access.redhat.com/errata/RHSA-2018:1347 https://access.redhat.com/errata/RHSA-2018:1348 https://access.redhat.com/errata/RHSA-2018:1349 https://access.redhat.com/errata/RHSA-2018:1350 https://access.redhat.com/errata/RHSA-2018:1351 https://access.redhat.com/errata/RHSA-2018:1352 https://access.redhat.com/errata/RHSA-2018:1353 https://access.redhat.com/errata/RHSA-2018:1354 https://access.redhat.com/errata/RHSA-2018:1355 https://access.redhat.com/errata/RHSA-2018:1524 https://bugzilla.redhat.com/show_bug.cgi?id=1567074 https://github.com/can1357/CVE-2018-8897/ https://github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 https://lists.debian.org/debian-lts-announce/2018/05/msg00015.html https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html https://lists.debian.org/debian-lts-announce/2018/11/msg00013.html https://patchwork.kernel.org/patch/10386677/ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897 https://security.netapp.com/advisory/ntap-20180927-0002/ https://support.apple.com/HT208742 https://support.citrix.com/article/CTX234679 https://svnweb.freebsd.org/base?view=revision&revision=333368 https://usn.ubuntu.com/3641-1/ https://usn.ubuntu.com/3641-2/ https://www.debian.org/security/2018/dsa-4196 https://www.debian.org/security/2018/dsa-4201 https://www.exploit-db.com/exploits/44697/ https://www.exploit-db.com/exploits/45024/ https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc https://www.kb.cert.org/vuls/id/631579 https://www.synology.com/support/security/Synology_SA_18_21 https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html https://xenbits.xen.org/xsa/advisory-260.html http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 http://openwall.com/lists/oss-security/2018/05/08/1 http://openwall.com/lists/oss-security/2018/05/08/4 http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-en http://www.securityfocus.com/bid/104071 http://www.securitytracker.com/id/1040744 http://www.securitytracker.com/id/1040849 http://www.securitytracker.com/id/1040861 http://www.securitytracker.com/id/1040866 http://www.securitytracker.com/id/1040882 https://access.redhat.com/errata/RHSA-2018:1318 https://access.redhat.com/errata/RHSA-2018:1319 https://access.redhat.com/errata/RHSA-2018:1345 https://access.redhat.com/errata/RHSA-2018:1346 https://access.redhat.com/errata/RHSA-2018:1347 https://access.redhat.com/errata/RHSA-2018:1348 https://access.redhat.com/errata/RHSA-2018:1349 https://access.redhat.com/errata/RHSA-2018:1350 https://access.redhat.com/errata/RHSA-2018:1351 https://access.redhat.com/errata/RHSA-2018:1352 https://access.redhat.com/errata/RHSA-2018:1353 https://access.redhat.com/errata/RHSA-2018:1354 https://access.redhat.com/errata/RHSA-2018:1355 https://access.redhat.com/errata/RHSA-2018:1524 https://bugzilla.redhat.com/show_bug.cgi?id=1567074 https://github.com/can1357/CVE-2018-8897/ https://github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 https://lists.debian.org/debian-lts-announce/2018/05/msg00015.html https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html https://lists.debian.org/debian-lts-announce/2018/11/msg00013.html https://patchwork.kernel.org/patch/10386677/ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897 https://security.netapp.com/advisory/ntap-20180927-0002/ https://support.apple.com/HT208742 https://support.citrix.com/article/CTX234679 https://svnweb.freebsd.org/base?view=revision&revision=333368 https://usn.ubuntu.com/3641-1/ https://usn.ubuntu.com/3641-2/ https://www.debian.org/security/2018/dsa-4196 https://www.debian.org/security/2018/dsa-4201 https://www.exploit-db.com/exploits/44697/ https://www.exploit-db.com/exploits/45024/ https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc https://www.kb.cert.org/vuls/id/631579 https://www.synology.com/support/security/Synology_SA_18_21 https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html https://xenbits.xen.org/xsa/advisory-260.html

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.8

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity HIGH

7.2

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:L/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2018-8897 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/can1357/CVE-2018-8897

View Code

GitHub https://github.com/nmulasmajic/syscall_exploit_CVE-2018-8897

View Code

GitHub https://github.com/nmulasmajic/CVE-2018-8897

View Code

GitHub https://github.com/jiazhang0/pop-mov-ss-exploit

View Code

Exploit-DB https://www.exploit-db.com/exploits/44697

View Code

Exploit-DB https://www.exploit-db.com/exploits/45024

View Code

June 17, 2026 MODIFIED

Vulnerability data updated via NVD.

November 21, 2024 MODIFIED

Vulnerability data or affected products updated.

May 08, 2018 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector LOCAL

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.