Skip to content
Fencer Intel
medium 5.5

CVE-2017-7518 json

A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulati…

published 2018-07-30 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16535

cvss
5.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this.

Patch / fix

  • linux linux_kernel 4.12
  • linux Debian 14, Debian 13, Debian 12 4.11.11-1

debian advisories DEBIAN-CVE-2017-7518

  • linux Ubuntu 14.04 LTS 3.13.0-157.207
  • linux Ubuntu 16.04 LTS 4.4.0-119.143
  • linux-aws Ubuntu 14.04 LTS 4.4.0-1016.16
  • linux-aws Ubuntu 16.04 LTS 4.4.0-1054.63
  • linux-gcp Ubuntu 16.04 LTS 4.13.0-1002.5
  • linux-hwe Ubuntu 16.04 LTS 4.13.0-32.35~16.04.1
  • linux-kvm Ubuntu 16.04 LTS 4.4.0-1020.25
  • linux-raspi2 Ubuntu 16.04 LTS 4.4.0-1086.94

ubuntu advisories UBUNTU-CVE-2017-7518

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 7 3.10.0-693.21.1.el7
  • perf RHEL 7 3.10.0-693.21.1.el7
  • python-perf RHEL 7 3.10.0-693.21.1.el7
  • kernel-kdump RHEL 7 3.10.0-693.21.1.el7
  • kernel-tools RHEL 7 3.10.0-693.21.1.el7
  • kernel-tools-libs RHEL 7 3.10.0-693.21.1.el7
  • kernel-bootwrapper RHEL 7 3.10.0-693.21.1.el7
  • kernel-abi-whitelists RHEL 7 3.10.0-693.21.1.el7

red hat advisories RHSA-2018:0395RHSA-2018:0412

  • kernel-rt SLE Real Time 12 SP2 4.4.88-18.1
  • kernel-syms-rt SLE Real Time 12 SP2 4.4.88-18.1
  • kernel-rt_debug SLE Real Time 12 SP2 4.4.88-18.1
  • kernel-source-rt SLE Real Time 12 SP2 4.4.88-18.1
  • kernel-ec2 SLE Module for Public Cloud 12 3.12.61-52.101.1
  • kernel-ec2 SLE Module for Public Cloud 12 3.12.74-60.64.63.1
  • kernel-xen SLES for SAP 12 SP1, SLES 12 SP1-LTSS, OpenStack Cloud 6 3.12.74-60.64.63.1
  • kernel-syms SLES for SAP 12 SP1, SLES 12 SP1-LTSS, OpenStack Cloud 6 3.12.74-60.64.63.1

suse advisories SUSE-SU-2017:2956-1SUSE-SU-2017:2920-1SUSE-SU-2017:2908-1SUSE-SU-2017:2869-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-7518 updated cvss 5.5

Kernel: KVM: debug exception via syscall emulation

  • Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-693.21.1.el7, kernel 3.10.0-693.21.1.el7, python-perf 3.10.0-693.21.1.el7, kernel-tools 3.10.0-693.21.1.el7, kernel-tools-libs 3.10.0-693.21.1.el7, kernel-abi-whitelists 3.10.0-693.21.1.el7, +1 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-693.21.1.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-693.21.1.el7, kernel 3.10.0-693.21.1.el7, python-perf 3.10.0-693.21.1.el7, kernel-tools 3.10.0-693.21.1.el7, kernel-tools-libs 3.10.0-693.21.1.el7, kernel-abi-whitelists 3.10.0-693.21.1.el7, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-693.21.1.el7
    fixed: vendor fix RHSA-2018:0395
  • Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-693.21.1.rt56.639.el7, kernel-rt-kvm 3.10.0-693.21.1.rt56.639.el7, kernel-rt-trace 3.10.0-693.21.1.rt56.639.el7, kernel-rt-debug-kvm 3.10.0-693.21.1.rt56.639.el7, kernel-rt-trace-kvm 3.10.0-693.21.1.rt56.639.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-693.21.1.rt56.639.el7 Red Hat Enterprise Linux Realtime (v. 7) kernel-rt 3.10.0-693.21.1.rt56.639.el7, kernel-rt-trace 3.10.0-693.21.1.rt56.639.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-693.21.1.rt56.639.el7
    fixed: vendor fix RHSA-2018:0412
  • Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-693.21.1.el7, kernel 3.10.0-693.21.1.el7, python-perf 3.10.0-693.21.1.el7, kernel-kdump 3.10.0-693.21.1.el7, kernel-tools 3.10.0-693.21.1.el7, kernel-tools-libs 3.10.0-693.21.1.el7, +6 more Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-693.21.1.el7, kernel-debuginfo-common-x86_64 3.10.0-693.21.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-693.21.1.el7 Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-693.21.1.el7, kernel 3.10.0-693.21.1.el7, python-perf 3.10.0-693.21.1.el7, kernel-tools 3.10.0-693.21.1.el7, kernel-tools-libs 3.10.0-693.21.1.el7, kernel-abi-whitelists 3.10.0-693.21.1.el7, +1 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-693.21.1.el7
    fixed: vendor fix RHSA-2018:0395
  • Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, python-perf, kernel-kdump, kernel-tools, kernel-tools-libs, +2 more Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 5.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • [UNKNOWN] Kernel:

Classification

Weakness
  • CWE-250 Execution with Unnecessary Privileges
  • CWE-755 Improper Handling of Exceptional Conditions
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.