CVE-2017-12188

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun."

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-22

Affected software

Vendor	Product	Versions
n/a	Linux kernel	Linux kernel

References

http://www.securityfocus.com/bid/101267Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0395Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0412Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1500380Issue Tracking, Patch, Third Party Advisory
https://patchwork.kernel.org/patch/9996579/Issue Tracking, Patch, Vendor Advisory
https://patchwork.kernel.org/patch/9996587/Issue Tracking, Patch, Vendor Advisory
http://www.securityfocus.com/bid/101267Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0395Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0412Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1500380Issue Tracking, Patch, Third Party Advisory
https://patchwork.kernel.org/patch/9996579/Issue Tracking, Patch, Vendor Advisory
https://patchwork.kernel.org/patch/9996587/Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Oct 11, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-121897.8It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handlin CVE-2017-12196.5IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could CVE-2017-121906.5The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O CVE-2017-121917.4A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access CVE-2017-121925.5The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properl CVE-2017-121935.5The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which CVE-2017-121949.8A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-ser CVE-2017-121954.8A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name CVE-2017-121965.9undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not en CVE-2017-121976.5It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password CVE-2017-121999.8The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue CVE-2017-12205.3IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) discloses sensitive information to unauthorized users. The information can be