CVE-2017-12188

What it actually does

The flaw in arch/x86/kvm/mmu.c fails to correctly traverse guest page table entries during address resolution under nested virtualization, producing an incorrect index that triggers a stack buffer overrun and allows L1 guest code to execute on the host or crash the host kernel.

Why it matters to the business

Compromise of a single virtual machine can extend to full control of the physical host or cause widespread denial of service, exposing hosted workloads, data, and infrastructure availability in any environment that relies on KVM nested virtualization.

How an attack unfolds

An attacker who already controls an L1 guest operating system enables nested virtualization, supplies malicious guest page table structures, and forces the host KVM MMU to walk those tables; the resulting bad index overwrites the stack, granting arbitrary code execution or a host crash.

How to fix it

Upgrade the Linux kernel on all affected hosts to a version containing the MMU traversal fix (beyond 4.13.5) and reboot; if nested virtualization is unnecessary, disable it via KVM module parameters until the update can be applied.

How to confirm the fix worked

Confirm that running kernel versions on hosts exceed 4.13.5, exercise nested virtualization workloads in a test environment to verify absence of crashes, and review kernel build logs or package manifests for the applied patch.

Typical attack path

1. Obtain code execution inside an L1 guest virtual machine
2. Activate nested virtualization features inside that guest
3. Construct and load crafted guest page table entries
4. Trigger address resolution that exercises the vulnerable MMU walk path
5. Leverage the stack overrun for host-level code execution or denial of service

How to detect it

Review host kernel logs for KVM MMU oops or stack overflow messages, correlate guest-initiated page table operations with host crashes, and examine any available nested virtualization audit trails for anomalous address resolution activity.

What your security team should do

• Apply kernel updates to all KVM hosts immediately
• Disable nested virtualization on hosts where it is not required
• Audit virtual machine inventory for use of nested virtualization features
• Incorporate KVM MMU-related kernel oops monitoring into existing alerting