Back
CVE-2017-12154
The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and…
High7.1EPSS 0.51%
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.1 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.51% · top 56% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
- incorrect access control
Affected products
Linux kernel through 4.13.3
- affected Linux kernel through 4.13.3
References (11)
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51aa68e7d57e3217192d88ce90fd5b8ef29ec94f (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=1491224 (opens in a new tab)x_refsource_CONFIRMx_transferred
- RHSA-2018:1062 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- 100856 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- DSA-3981 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- https://www.spinics.net/lists/kvm/msg155414.html (opens in a new tab)x_refsource_CONFIRMx_transferred
- RHSA-2018:0676 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- USN-3698-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
- https://github.com/torvalds/linux/commit/51aa68e7d57e3217192d88ce90fd5b8ef29ec94f (opens in a new tab)x_refsource_CONFIRMx_transferred
- USN-3698-2 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
- RHSA-2019:1946 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-12154)Record last updated .