CVE-2017-12188
published 2017-10-11CVE-2017-12188: arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a…
PriorityP340high7.8CVSS 3.1
AVLACHPRLUINSCCHIHAH
EPSS
0.44%
35.8th percentile
arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun."
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.13.4-2 (bookworm) | linux 4.13.4-2 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 4.13.4-2 | 4.13.4-2 |
| linux | linux_kernel | >= 0 < 4.13.4-2 | 4.13.4-2 |
| linux | linux_kernel | >= 0 < 4.13.4-2 | 4.13.4-2 |
| linux | linux_kernel | >= 0 < 4.13.4-2 | 4.13.4-2 |
| linux | linux_kernel | >= 4.10 < 4.13.8 | 4.13.8 |
| linux | linux_kernel | >= 4.6 < 4.9.57 | 4.9.57 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q7q6-h2q3-86p9: arch/x86/kvm/mmu
ghsa_unreviewed·2022-05-14
CVE-2017-12188 [HIGH] CWE-121 GHSA-q7q6-h2q3-86p9: arch/x86/kvm/mmu
arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun."
OSV
CVE-2017-12188: arch/x86/kvm/mmu
osv·2017-10-11·CVSS 7.8
CVE-2017-12188 [HIGH] CVE-2017-12188: arch/x86/kvm/mmu
arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun."
Kernel
KVM: nVMX: update last_nonleaf_level when initializing nested EPT
kernel_security·2017-10-05·CVSS 7.8
CVE-2017-12188 [HIGH] KVM: nVMX: update last_nonleaf_level when initializing nested EPT
KVM: nVMX: update last_nonleaf_level when initializing nested EPT
The function updates context->root_level but didn't call
update_last_nonleaf_level so the previous and potentially wrong value
was used for page walks. For example, a zero value of last_nonleaf_level
would allow a potential out-of-bounds access in arch/x86/mmu/paging_tmpl.h's
walk_addr_generic function (CVE-2017-12188).
Fixes: 155a97a3d7c78b46cef6f1a973c831bc5a4f82bb
Signed-off-by: Ladi Prosek
Signed-off-by: Paolo Bonzini
Kernel
KVM: MMU: always terminate page walks at level 1
kernel_security·2017-10-05·CVSS 7.8
CVE-2017-12188 [HIGH] KVM: MMU: always terminate page walks at level 1
KVM: MMU: always terminate page walks at level 1
is_last_gpte() is not equivalent to the pseudo-code given in commit
6bb69c9b69c31 ("KVM: MMU: simplify last_pte_bitmap") because an incorrect
value of last_nonleaf_level may override the result even if level == 1.
It is critical for is_last_gpte() to return true on level == 1 to
terminate page walks. Otherwise memory corruption may occur as level
is used as an index to various data structures throughout the page
walking code. Even though the actual bug would be wherever the MMU is
initialized (as in the previous patch), be defensive and ensure here
that is_last_gpte() returns the correct value.
This patch is also enough to fix CVE-2017-12188.
Fixes: 6bb69c9b69c315200ddc2bc79aee14c0184cf5b2
Cc: [email protected]
Cc: Andy Honig
Signed
Ubuntu
Linux kernel (HWE) vulnerability
vendor_ubuntu·2017-11-21
CVE-2017-12188 Linux kernel (HWE) vulnerability
Title: Linux kernel (HWE) vulnerability
Summary: The system could be made to crash or run programs as an administrator.
USN-3484-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS.
It was discovered that the KVM subsystem in the Linux kernel did not
properly keep track of nested levels in guest page tables. A local attacker
in a guest VM could use this to cause a denial of service (host OS crash)
or possibly execute arbitrary code in the host OS.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new ve
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-11-21·CVSS 5.5
CVE-2017-1000255 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the KVM subsystem in the Linux kernel did not
properly keep track of nested levels in guest page tables. A local attacker
in a guest VM could use this to cause a denial of service (host OS crash)
or possibly execute arbitrary code in the host OS. (CVE-2017-12188)
It was discovered that on the PowerPC architecture, the kernel did not
properly sanitize the signal stack when handling sigreturn(). A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-1000255)
Bo Zhang discovered that the netlink wireless configuration interface in
the Linux kernel did not properly validate attributes when handling cer
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2017-11-21
CVE-2017-12188 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system could be made to crash or run programs as an administrator.
It was discovered that the KVM subsystem in the Linux kernel did not
properly keep track of nested levels in guest page tables. A local attacker
in a guest VM could use this to cause a denial of service (host OS crash)
or possibly execute arbitrary code in the host OS.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-gen
Ubuntu
Linux kernel (Azure) vulnerability
vendor_ubuntu·2017-11-21
CVE-2017-12188 Linux kernel (Azure) vulnerability
Title: Linux kernel (Azure) vulnerability
Summary: The system could be made to crash or run programs as an administrator.
It was discovered that the KVM subsystem in the Linux kernel did not
properly keep track of nested levels in guest page tables. A local attacker
in a guest VM could use this to cause a denial of service (host OS crash)
or possibly execute arbitrary code in the host OS.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, l
Ubuntu
Linux kernel (GCP) vulnerability
vendor_ubuntu·2017-11-21
CVE-2017-12188 Linux kernel (GCP) vulnerability
Title: Linux kernel (GCP) vulnerability
Summary: The system could be made to crash or run programs as an administrator.
It was discovered that the KVM subsystem in the Linux kernel did not
properly keep track of nested levels in guest page tables. A local attacker
in a guest VM could use this to cause a denial of service (host OS crash)
or possibly execute arbitrary code in the host OS.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, lin
Red Hat
Kernel: KVM: MMU potential stack buffer overrun during page walks
vendor_redhat·2017-10-10·CVSS 7.8
CVE-2017-12188 [HIGH] CWE-121 Kernel: KVM: MMU potential stack buffer overrun during page walks
Kernel: KVM: MMU potential stack buffer overrun during page walks
arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun."
The Linux kernel built with the KVM visualization support (CONFIG_KVM), with nested visualization(nVMX) feature enabled (nested=1), was vulnerable to a stack buffer overflow issue. The vulnerability could occur while traversing guest page table entries to resolve guest virtual address(gva). An L1 guest could use this flaw to crash the host kernel r
Debian
CVE-2017-12188: linux - arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisatio...
vendor_debian·2017·CVSS 7.8
CVE-2017-12188 [HIGH] CVE-2017-12188: linux - arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisatio...
arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun."
Scope: local
bookworm: resolved (fixed in 4.13.4-2)
bullseye: resolved (fixed in 4.13.4-2)
forky: resolved (fixed in 4.13.4-2)
sid: resolved (fixed in 4.13.4-2)
trixie: resolved (fixed in 4.13.4-2)
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/101267https://access.redhat.com/errata/RHSA-2018:0395https://access.redhat.com/errata/RHSA-2018:0412https://bugzilla.redhat.com/show_bug.cgi?id=1500380https://patchwork.kernel.org/patch/9996579/https://patchwork.kernel.org/patch/9996587/http://www.securityfocus.com/bid/101267https://access.redhat.com/errata/RHSA-2018:0395https://access.redhat.com/errata/RHSA-2018:0412https://bugzilla.redhat.com/show_bug.cgi?id=1500380https://patchwork.kernel.org/patch/9996579/https://patchwork.kernel.org/patch/9996587/
2017-10-11
Published