CVE-2017-1000252: linux linux_kernel Improper Input Validation
Vulnerability summary
CVE-2017-1000252 is a medium (CVSS 5.5) Improper Input Validation vulnerability in linux linux_kernel. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 39.2% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 5Timeline
- 26-09-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.45% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu17 products
- linux< 4.4.0-98.121
- linux-aws< 4.4.0-1039.48
- linux-azure< 4.13.0-1005.7 | All versions (No fix recorded)
- linux-azure-fdeAll versions (No fix recorded)
- linux-gcp< 4.10.0-1008.8 | All versions (No fix recorded)
Debian1 product
- linux< 4.12.13-1
Linux1 product
- linux_kernel≤ 4.13.3
3 vendors · 19 products
References
19 links- github.com/torvalds/linux/commit/3a8b0677fc6180a467e26cc32ce6b0c09a32f9bbX Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- github.com/torvalds/linux/commit/36ae3c0a36b7456432fedce38ae2f7bd3e01a563X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
Show all 19 references
- www.openwall.com/lists/oss-security/2017/09/15/4X Refsource CONFIRMMailing ListPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1490781X Refsource CONFIRMIssue TrackingPatchThird Party Advisory