Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.2
CVSSv2

CVE-2012-0217

Published: 12/06/2012 Updated: 28/09/2020
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
VMScore: 736
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Subscribe to Freebsd

Vulnerability Summary

The x86-64 kernel system-call functionality in Xen 4.1.2 and previous versions, as used in Citrix XenServer 6.0.2 and previous versions and other products; Oracle Solaris 11 and previous versions; illumos before r13724; Joyent SmartOS prior to 20120614T184600Z; FreeBSD prior to 9.0-RELEASE-p3; NetBSD 6.0 Beta and previous versions; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

freebsd freebsd

illumos illumos

joyent smartos

xen xen 4.0.4

xen xen 4.1.0

xen xen 4.0.2

xen xen 4.0.3

xen xen 4.1.1

xen xen

xen xen 4.0.0

xen xen 4.0.1

microsoft windows 7

microsoft windows server 2008 r2

microsoft windows server 2003

microsoft windows xp

citrix xenserver 6.0

citrix xenserver

netbsd netbsd

sun sunos

Vendor Advisories

Red Hat: Important: kernel security update
Synopsis Important: kernel security update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix two security issues are now available forRed Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability S ...
Red Hat: Important: kernel security and bug fix update
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix two security issues and multiple bugs arenow available for Red Hat Enterprise Linux 56 Extended Update SupportThe Red Hat Security Response Team has rated this update as ...
Debian CVElist Bug Report Logs: kfreebsd-8: cve-2012-0217
Debian Bug report logs - #677297 kfreebsd-8: cve-2012-0217 Package: kfreebsd-8; Maintainer for kfreebsd-8 is (unknown); Reported by: Michael Gilbert <mgilbert@debianorg> Date: Wed, 13 Jun 2012 02:27:02 UTC Severity: grave Tags: security, squeeze Found in versions kfreebsd-8/83-3, 81+dfsg-8+squeeze2, 82-15~bpo60+1 Fixe ...
Debian Security Advisories: DSA-2501-1 xen -- several vulnerabilities
Several vulnerabilities were discovered in Xen, a hypervisor CVE-2012-0217 Xen does not properly handle uncanonical return addresses on Intel amd64 CPUs, allowing amd64 PV guests to elevate to hypervisor privileges AMD processors, HVM and i386 guests are not affected CVE-2012-0218 Xen does not properly handle SYSCALL and SYSENTER instructi ...

Exploits

Exploit DB: FreeBSD Intel SYSRET Privilege Escalation
This Metasploit module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit Intel processors By design, 64-bit processors following the X86-64 specification will trigger a general protection fault (GPF) when executing a SYSRET instruction with a non-canonical address in the RCX register However, Intel processors check for a non- ...
Exploit DB: FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation
/* * FreeBSD 90 Intel SYSRET Kernel Privilege Escalation exploit * Author by CurcolHekerLink * * This exploit based on open source project, I can make it open source too Right? * * If you blaming me for open sourcing this exploit, you can fuck your mom Free of charge :) * * Credits to KEPEDEAN Corp, Barisan Sakit Hati, ora iso sepaying ...
Exploit DB: FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)
## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = GreatRanking include Msf::Post::File include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info ...
Exploit DB: Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042)
Source: packetstormsecurityorg/files/115908/sysretrar This is proof of concept code that demonstrates the Microsoft Windows kernel (Intel/x64) SYSRET vulnerability as described in MS12-042 The shellcode disables code signing and will grant NT SYSTEM privileges to a specified application or already running process Exploit-DB Mirror: htt ...

Github Repositories

https://github.com/dabumana/Open-Security-Training-Architecture

Architecture internals learning path from Open Security Training, provides a set of resources to complete the learning path, includes code-base, videos, techniques, useful articles and concepts to understand the courses.

🔑 Open Security Training Architecture Architecture internals learning path from Open Security Training, provides a set of resources to complete the learning path, includes code-base, videos, techniques, useful articles and concepts to understand the courses provided from Open Security Training Register in post2fyi Resources Videos: wwwyoutubecom/watch?v=eItru0

https://github.com/felixlinker/ifc-rv-thesis

My master thesis on information flow control on a minimal version of the RISC-V architecture with a model checker

ifc-rv-thesis This repository holds the master thesis of me, Felix Linker, and the code that comes with it The thesis is about information flow tracking for instruction set architectures using model checking I apply my approach to the RISC-V ISA This is the abstract of the thesis: This thesis proposes an approach to formally verifying instruction set architectures against h

https://github.com/dabumana/Open-Security-Training-Architecture-Code-Base

Architecture internals learning path from Open Security Training, provides a set of resources to complete the learning path, includes code-base, videos, techniques, useful articles and concepts to understand the courses.

🔑 Open Security Training Architecture Architecture internals learning path from Open Security Training, provides a set of resources to complete the learning path, includes code-base, videos, techniques, useful articles and concepts to understand the courses provided from Open Security Training Register in post2fyi Resources Videos: wwwyoutubecom/watch?v=eItru0

Recent Articles

Robbing a bank? Carberp toolkit now available for just $5k
The Register • John Leyden • 18 Jun 2013

Trojan forum sale may mark split in Carberp gang

Cybercrooks are selling the source code for the Carberp banking Trojan toolkit through underground forums - at just $5,000 a pop. The sale of the building blocks for the banking Trojan toolkit is a sign of "conflict within the team", according to Andrey Komarov of Russian security firm Group-IB. "Some of the members would love to destroy the project and move onto another business or new product," Komarov told El Reg. The toolkit for sale consists of the full source code of Carberp, including: co...

Read more...

References

CWE-119https://www.illumos.org/issues/2873http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.htmlhttp://smartos.org/2012/06/15/smartos-news-3/http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.aschttp://support.citrix.com/article/CTX133161https://bugzilla.redhat.com/show_bug.cgi?id=813428http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012http://lists.xen.org/archives/html/xen-devel/2012-06/msg01072.htmlhttp://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/http://www.kb.cert.org/vuls/id/649219http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.aschttp://www.debian.org/security/2012/dsa-2508http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlhttp://www.debian.org/security/2012/dsa-2501http://www.us-cert.gov/cas/techalerts/TA12-164A.htmlhttp://secunia.com/advisories/55082http://security.gentoo.org/glsa/glsa-201309-24.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:150https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15596https://www.exploit-db.com/exploits/28718/https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042https://www.exploit-db.com/exploits/46508/https://access.redhat.com/errata/RHSA-2012:0721https://nvd.nist.govhttps://github.com/dabumana/Open-Security-Training-Architecturehttps://www.exploit-db.com/exploits/28718/https://www.kb.cert.org/vuls/id/649219
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-38298CVE-2024-20356CVE-2023-21987CVE-2024-33217bypassCVE-2024-31804CVE-2024-32660unauthorizedSSRF
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook