In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12904.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"266830062958211846985739725471923435204",
"275159045404150457943598496458113672697",
"310282692848557111063356357008962674447",
"237437871657425512404047854067481065321",
"155606489138129667696370071869607901527",
"118645292413263595167966435685380195599",
"250213335695991264552656462497491469735",
"194317286251639035011663837910427196770",
"126309064245340346739651280003564458751",
"153500099576176141627442282906269771425",
"116775312301770051423104122986607515135",
"266989037553859165959564572367792732888",
"1291677961233674407244924024897962077"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2018-12904-56fa81dc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@727ba748e110b4de50d142edca9d6a9b7e6111d8",
"target": {
"file": "arch/x86/kvm/vmx.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1096.0,
"function_hash": "139735310681338702952755399263951367488"
},
"signature_type": "Function",
"id": "CVE-2018-12904-83dee3d6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@727ba748e110b4de50d142edca9d6a9b7e6111d8",
"target": {
"function": "handle_vmon",
"file": "arch/x86/kvm/vmx.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 148.0,
"function_hash": "232195256880762811363235266047253166842"
},
"signature_type": "Function",
"id": "CVE-2018-12904-9a1b2d35",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@727ba748e110b4de50d142edca9d6a9b7e6111d8",
"target": {
"function": "nested_vmx_check_permission",
"file": "arch/x86/kvm/vmx.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12904.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"266830062958211846985739725471923435204",
"275159045404150457943598496458113672697",
"310282692848557111063356357008962674447",
"237437871657425512404047854067481065321",
"155606489138129667696370071869607901527",
"118645292413263595167966435685380195599",
"250213335695991264552656462497491469735",
"194317286251639035011663837910427196770",
"126309064245340346739651280003564458751",
"153500099576176141627442282906269771425",
"116775312301770051423104122986607515135",
"266989037553859165959564572367792732888",
"1291677961233674407244924024897962077"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2018-12904-88c7cb0b",
"source": "https://github.com/torvalds/linux/commit/727ba748e110b4de50d142edca9d6a9b7e6111d8",
"target": {
"file": "arch/x86/kvm/vmx.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 148.0,
"function_hash": "232195256880762811363235266047253166842"
},
"signature_type": "Function",
"id": "CVE-2018-12904-db26faa5",
"source": "https://github.com/torvalds/linux/commit/727ba748e110b4de50d142edca9d6a9b7e6111d8",
"target": {
"function": "nested_vmx_check_permission",
"file": "arch/x86/kvm/vmx.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1096.0,
"function_hash": "139735310681338702952755399263951367488"
},
"signature_type": "Function",
"id": "CVE-2018-12904-fcc68eef",
"source": "https://github.com/torvalds/linux/commit/727ba748e110b4de50d142edca9d6a9b7e6111d8",
"target": {
"function": "handle_vmon",
"file": "arch/x86/kvm/vmx.c"
}
}
]