CVE-2017-12154

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register.

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	Linux kernel through 4.13.3	Linux kernel through 4.13.3

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51aa68e7d57e3217192d88ce90fd5b8ef29ec94fIssue Tracking, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3981
http://www.securityfocus.com/bid/100856Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0676
https://access.redhat.com/errata/RHSA-2018:1062
https://access.redhat.com/errata/RHSA-2019:1946
https://bugzilla.redhat.com/show_bug.cgi?id=1491224Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/51aa68e7d57e3217192d88ce90fd5b8ef29ec94fIssue Tracking, Patch, Third Party Advisory
https://usn.ubuntu.com/3698-1/
https://usn.ubuntu.com/3698-2/
https://www.spinics.net/lists/kvm/msg155414.htmlMailing List, Patch, Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51aa68e7d57e3217192d88ce90fd5b8ef29ec94fIssue Tracking, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3981
http://www.securityfocus.com/bid/100856Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0676
https://access.redhat.com/errata/RHSA-2018:1062
https://access.redhat.com/errata/RHSA-2019:1946
https://bugzilla.redhat.com/show_bug.cgi?id=1491224Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/51aa68e7d57e3217192d88ce90fd5b8ef29ec94fIssue Tracking, Patch, Third Party Advisory
https://usn.ubuntu.com/3698-1/
https://usn.ubuntu.com/3698-2/
https://www.spinics.net/lists/kvm/msg155414.htmlMailing List, Patch, Third Party Advisory

Timeline

Published: Sep 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-121556.3A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world CVE-2017-121566.1Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.CVE-2017-121574.3In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.CVE-2017-121585.4It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker c CVE-2017-121597.5It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain ac CVE-2017-121607.2It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serve CVE-2017-121618.8It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset reque CVE-2017-121637.1An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.CVE-2017-121646.4A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled CVE-2017-121657.5It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause poss CVE-2017-121669.8OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly r CVE-2017-121675.5It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user t