CVE-2018-12904

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL.

Metrics

CVSS 3.0 4.9/10CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=727ba748e110b4de50d142edca9d6a9b7e6111d8Patch, Vendor Advisory
https://bugs.chromium.org/p/project-zero/issues/detail?id=1589Exploit, Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.2Release Notes, Vendor Advisory
https://github.com/torvalds/linux/commit/727ba748e110b4de50d142edca9d6a9b7e6111d8Patch, Third Party Advisory
https://usn.ubuntu.com/3752-1/Third Party Advisory
https://usn.ubuntu.com/3752-2/Third Party Advisory
https://usn.ubuntu.com/3752-3/Third Party Advisory
https://www.exploit-db.com/exploits/44944/Exploit, Third Party Advisory, VDB Entry
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=727ba748e110b4de50d142edca9d6a9b7e6111d8Patch, Vendor Advisory
https://bugs.chromium.org/p/project-zero/issues/detail?id=1589Exploit, Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.2Release Notes, Vendor Advisory
https://github.com/torvalds/linux/commit/727ba748e110b4de50d142edca9d6a9b7e6111d8Patch, Third Party Advisory
https://usn.ubuntu.com/3752-1/Third Party Advisory
https://usn.ubuntu.com/3752-2/Third Party Advisory
https://usn.ubuntu.com/3752-3/Third Party Advisory
https://www.exploit-db.com/exploits/44944/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jun 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-129056.1joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions.CVE-2018-129077.5In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmiss CVE-2018-129089.8Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a CVE-2018-129097.5Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has acc CVE-2018-12918.1Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entit CVE-2018-129109.8The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.CVE-2018-129119.8WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src CVE-2018-129127.2An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/da CVE-2018-129137.5In Miniz 2.0.7, tinfl_decompress in miniz_tinfl.c has an infinite loop because sym2 and counter can both remain equal to zero.CVE-2018-129149.8A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with CVE-2018-129159.8In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.CVE-2018-129169.8In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcP_message_default in proto.c.