CVE-2012-0217
FreeBSD - Intel SYSRET Privilege Escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
El modo de usuario Scheduler en el núcleo en Microsoft Windows Server v2008 R2 y R2 SP1 y Windows v7 Gold y SP1 sobre la plataforma x64 no maneja adecuadamente solicitudes del sistema, lo que permite a usuarios locales obtener privilegios a través de una aplicación modificada, también conocida como "vulnerabilidad de corrupción de memoria de modo de usuario Scheduler".
It was found that the Xen hypervisor implementation as shipped with Red Hat Enterprise Linux 5 did not properly restrict the syscall return addresses in the sysret return path to canonical addresses. An unprivileged user in a 64-bit para-virtualized guest, that is running on a 64-bit host that has an Intel CPU, could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the hypervisor level.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2011-12-14 CVE Reserved
- 2012-06-12 CVE Published
- 2012-08-27 First Exploit
- 2024-03-11 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (30)
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/46508 | 2024-08-06 | |
| https://www.exploit-db.com/exploits/28718 | 2024-08-06 | |
| https://www.exploit-db.com/exploits/20861 | 2012-08-27 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | <= 9.0 Search vendor "Freebsd" for product "Freebsd" and version " <= 9.0" | - |
Affected
| ||||||
| Illumos Search vendor "Illumos" | Illumos Search vendor "Illumos" for product "Illumos" | <= r13723 Search vendor "Illumos" for product "Illumos" and version " <= r13723" | - |
Affected
| ||||||
| Joyent Search vendor "Joyent" | Smartos Search vendor "Joyent" for product "Smartos" | <= 20120614 Search vendor "Joyent" for product "Smartos" and version " <= 20120614" | - |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | <= 4.1.2 Search vendor "Xen" for product "Xen" and version " <= 4.1.2" | - |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.0.0 Search vendor "Xen" for product "Xen" and version "4.0.0" | - |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.0.1 Search vendor "Xen" for product "Xen" and version "4.0.1" | - |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.0.2 Search vendor "Xen" for product "Xen" and version "4.0.2" | - |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.0.3 Search vendor "Xen" for product "Xen" and version "4.0.3" | - |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.0.4 Search vendor "Xen" for product "Xen" and version "4.0.4" | - |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.1.0 Search vendor "Xen" for product "Xen" and version "4.1.0" | - |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.1.1 Search vendor "Xen" for product "Xen" and version "4.1.1" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 7 Search vendor "Microsoft" for product "Windows 7" | * | x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 7 Search vendor "Microsoft" for product "Windows 7" | * | sp1, x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Server 2003 Search vendor "Microsoft" for product "Windows Server 2003" | * | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | r2 Search vendor "Microsoft" for product "Windows Server 2008" and version "r2" | x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Xp Search vendor "Microsoft" for product "Windows Xp" | * | sp3 |
Affected
| ||||||
| Citrix Search vendor "Citrix" | Xenserver Search vendor "Citrix" for product "Xenserver" | <= 6.0.2 Search vendor "Citrix" for product "Xenserver" and version " <= 6.0.2" | - |
Affected
| ||||||
| Citrix Search vendor "Citrix" | Xenserver Search vendor "Citrix" for product "Xenserver" | 6.0 Search vendor "Citrix" for product "Xenserver" and version "6.0" | - |
Affected
| ||||||
| Netbsd Search vendor "Netbsd" | Netbsd Search vendor "Netbsd" for product "Netbsd" | <= 6.0 Search vendor "Netbsd" for product "Netbsd" and version " <= 6.0" | beta |
Affected
| ||||||
| Sun Search vendor "Sun" | Sunos Search vendor "Sun" for product "Sunos" | <= 5.11 Search vendor "Sun" for product "Sunos" and version " <= 5.11" | - |
Affected
| ||||||