CVE-2017-12188: Buffer Overflow
arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun."
Other sources
Linux kernel built with the KVM virtualisation support(CONFIGKVM), with nested virtualisation(nVMX) feature enabled(nested=1), is vulnerable to a stack buffer overflow issue. It could occur while traversing guest pagetable entries to resolve guest virtual address(gva).
A L1 guest could use this flaw to crash the host kernel resulting in DoS. OR potentially execute arbitrary code on the host to gain access to the host system.
Upstream patch: --------------- -> https://www.spinics.net/lists/kvm/msg156651.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/10/12/17
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2017-12188.
What is the severity of CVE-2017-12188?
CVE-2017-12188 has a severity rating of high.
How does CVE-2017-12188 impact the Linux kernel?
CVE-2017-12188 allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service.
How can I fix CVE-2017-12188?
To fix CVE-2017-12188, update your Linux kernel to version 4.14.x or higher.
Where can I find more information about CVE-2017-12188?
You can find more information about CVE-2017-12188 at the following references: [1] [2] [3]