CVE-2017-12146

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

The driver_override implementation in drivers/base/platform.c in the Linux kernel before 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation that involve different overrides.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-121487.2A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition d CVE-2017-121499.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOn CVE-2017-121507.4It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration CVE-2017-121517.4A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3 CVE-2017-121534.4A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This f CVE-2017-121547.1The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-st CVE-2017-121556.3A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world CVE-2017-121566.1Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.CVE-2017-121574.3In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.CVE-2017-121585.4It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker c CVE-2017-121597.5It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain ac CVE-2017-121607.2It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serve