CVE-2017-12154

What it actually does

The prepare_vmcs02 function in arch/x86/kvm/vmx.c fails to ensure CR8-load exiting and CR8-store exiting L0 vmcs02 controls exist when L1 omits the use TPR shadow vmcs12 control, granting KVM L2 guest OS users direct read and write access to the hardware CR8 register.

Why it matters to the business

In virtualized Linux environments, compromised guest virtual machines may gain unauthorized access to host CPU interrupt controls, enabling further attacks on the hypervisor or co-located guests across a widely deployed kernel component.

How an attack unfolds

An attacker with code execution in an L2 guest OS issues operations that exploit the missing CR8 virtualization controls to directly read and write the hardware CR8 register, bypassing intended L0/L1 protections.

How to fix it

Update the Linux kernel to a version containing commit 51aa68e7d57e3217192d88ce90fd5b8ef29ec94f.

How to confirm the fix worked

Confirm the running kernel includes commit 51aa68e7d57e3217192d88ce90fd5b8ef29ec94f; exercise nested virtualization workloads and verify CR8 exiting controls are correctly set in vmcs02.

Typical attack path

1. Obtain code execution inside an L2 KVM guest virtual machine
2. Trigger nested VMCS preparation that omits TPR shadow usage
3. Directly access or modify the hardware CR8 register to alter interrupt priority
4. Escalate privileges or attempt hypervisor escape

How to detect it

Review kernel and KVM logs for unexpected nested VM exits or CR8 register accesses originating from guest contexts; examine auditd or dmesg entries related to vmx and cr8.

What your security team should do

• Apply the kernel fix containing commit 51aa68e7d57e3217192d88ce90fd5b8ef29ec94f to all affected hosts
• Audit and restrict nested virtualization usage where possible
• Monitor virtualization event logs for anomalous CR8-related exits