CVE-2012-0217
published 2012-06-12CVE-2012-0217: The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and…
PriorityP353high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
39.84%
98.6th percentile
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citrix | citrix_adm | — | — |
| citrix | citrix_hypervisor | — | — |
| citrix | citrix_virtual_apps_and_desktops | — | — |
| citrix | endpoint_management | — | — |
| citrix | netscaler_adc | — | — |
| citrix | netscaler_gateway | — | — |
| citrix | xenserver | <= 6.0.2 | — |
| citrix | xenserver | — | — |
| citrix | xenserver | — | — |
| debian | xen | < xen 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 (bookworm) | xen 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 (bookworm) |
| freebsd | freebsd | <= 9.0 | — |
| illumos | illumos | <= r13723 | — |
| joyent | smartos | <= 20120614 | — |
| microsoft | windows_server_2008 | — | — |
| netbsd | netbsd | <= 6.0 | — |
| sun | sunos | <= 5.11 | — |
| xen | xen | <= 4.1.2 | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | >= 0 < 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://github.com/iZsh/exploits/blob/master/stash/CVE-2012-0217-sysret/CVE-2012-0217-sysret_FreeBSD.c↗
bytes↗
\xb8\x18\x00\x00\x00\x48\x89\xe3\x48\xbc\xef\xbe\xad\xde\xef\xbe\xad\xde\x0f\x05
bytes↗
\x0f\x01\xf8\x48\x89\xdc\x48\xb8\xef\xbe\xad\xde\xef\xbe\xad\xde\xff\xe0
- →Exploit maps memory at the top of user-accessible virtual address space: (1ULL << 47) - pagesize, placing shellcode at the last page before the non-canonical boundary to trigger the SYSRET GPF in privileged mode. ↗
- →Exploit uses kldsym()/KLDSYM_LOOKUP to resolve kernel IDT handler symbols (Xdiv, Xdbg, Xprot, Xpage, etc.) from userland; alert on unprivileged processes calling kldsym() on FreeBSD. ↗
- →Metasploit module drops a randomly named hidden executable (dot-prefixed alphanumeric filename) compiled from sysret.c into a writable directory (default /tmp), then executes it; monitor for gcc compilation of C files followed by execution of dot-prefixed binaries in /tmp. ↗
- →The Windows PoC (MS12-042) shellcode disables code signing and grants NT SYSTEM privileges; on Windows, monitor for kernel-mode code-signing policy modifications following SYSRET-path exploitation. ↗
- →On Xen/Linux, vulnerable guests are 64-bit para-virtualized guests running on a 64-bit Intel host; Red Hat notes that Linux kernels with a guard page (CVE-2005-1764 fix) between user-mode VA space and non-canonical area are not affected — absence of this guard page is the exploitable condition. ↗
- ·Exploit only works on 64-bit Intel CPUs; AMD CPUs are not affected by this specific SYSRET flaw (a separate AMD erratum, CVE-2012-2934, causes a different DoS). ↗
- ·Red Hat Enterprise Linux 5/6 and MRG kernels are NOT vulnerable to the Linux kernel variant because they have a guard page (CVE-2005-1764 fix) and hardened syscall handler (CVE-2006-0744 fix); only the kernel-xen package on RHEL 5 is affected. ↗
- ·Metasploit module targets only FreeBSD 8.3-RELEASE and 9.0-RELEASE (amd64); other versions return CheckCode::Safe and will not be exploited unless ForceExploit is set. ↗
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.2HIGH
vendor_debian7.2HIGH
vendor_redhat2.1LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: x86-64: avoid sysret to non-canonical address
vendor_redhat·2012-06-12·CVSS 2.1
CVE-2012-0217 [LOW] kernel: x86-64: avoid sysret to non-canonical address
kernel: x86-64: avoid sysret to non-canonical address
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there
Red Hat
kernel: denial of service due to AMD Erratum #121
vendor_redhat·2012-06-12·CVSS 2.1
CVE-2012-2934 [LOW] kernel: denial of service due to AMD Erratum #121
kernel: denial of service due to AMD Erratum #121
Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217.
Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and 6, and Red Hat Enterprise MRG, as those versions have a guard page between the end of the user-mode accessible virtual address space and the beginning of the non-canonical area due to CVE-2005-1764 fix.
This issue did affect the versions of Xen hypervisor as shipped with Red Hat Enterprise Linux 5. A k
BSD
FreeBSD-SA-12:04.sysret: Privilege escalation when returning from kernel
bsd_advisories·2012-06-12·CVSS 7.2
CVE-2012-0217 [HIGH] FreeBSD-SA-12:04.sysret: Privilege escalation when returning from kernel
FreeBSD-SA-12:04.sysret Security Advisory
The FreeBSD Project
Topic: Privilege escalation when returning from kernel
Category: core
Module: sys_amd64
Announced: 2012-06-12
Credits: Rafal Wojtczuk, John Baldwin
Affects: All supported versions of FreeBSD
Corrected: 2012-06-12 12:10:10 UTC (RELENG_7, 7.4-STABLE)
2012-06-12 12:10:10 UTC (RELENG_7_4, 7.4-RELEASE-p9)
2012-06-12 12:10:10 UTC (RELENG_8, 8.3-STABLE)
2012-06-12 12:10:10 UTC (RELENG_8_3, 8.3-RELEASE-p3)
2012-06-12 12:10:10 UTC (RELENG_8_2, 8.2-RELEASE-p9)
2012-06-18 21:00:54 UTC (RELENG_8_1, 8.1-RELEASE-p12)
2012-06-12 12:10:10 UTC (RELENG_9, 9.0-STABLE)
2012-06-12 12:10:10 UTC (RELENG_9_0, 9.0-RELEASE-p3)
CVE Name: CVE-2012-0217
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields ab
Citrix
CVE-2012-0217: The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris
vendor_citrix·2012-06-12·CVSS 7.2
CVE-2012-0217 [HIGH] CWE-119 CVE-2012-0217: The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris
CVE-2012-0217: The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the origin
Debian
CVE-2012-0217: xen - The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in...
vendor_debian·2012·CVSS 7.2
CVE-2012-0217 [HIGH] CVE-2012-0217: xen - The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in...
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of t
Debian
CVE-2012-2934: xen - Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not p...
vendor_debian·2012·CVSS 7.2
CVE-2012-2934 [HIGH] CVE-2012-2934: xen - Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not p...
Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217.
Scope: local
bookworm: resolved (fixed in 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1)
bullseye: resolved (fixed in 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1)
forky: resolved (fixed in 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1)
sid: resolved (fixed in 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1)
trixie: resolved (fixed in 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1)
Citrix
Citrix Security Bulletin CTX133161
vendor_citrix·CVSS 7.2
CVE-2012-0217 [HIGH] Citrix Security Bulletin CTX133161
Citrix Security Bulletin CTX133161
CVE References: CVE-2012-0217, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
GHSA
GHSA-48m3-5gf3-cq84: Xen 4
ghsa_unreviewed·2022-05-17·CVSS 7.2
CVE-2012-2934 [HIGH] GHSA-48m3-5gf3-cq84: Xen 4
Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217.
GHSA
GHSA-q644-363q-jfmm: The x86-64 kernel system-call functionality in Xen 4
ghsa_unreviewed·2022-05-04
CVE-2012-0217 [HIGH] CWE-119 GHSA-q644-363q-jfmm: The x86-64 kernel system-call functionality in Xen 4
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of t
OSV
CVE-2012-2934: Xen 4
osv·2012-12-03·CVSS 7.2
CVE-2012-2934 [HIGH] CVE-2012-2934: Xen 4
Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217.
OSV
CVE-2012-0217: The x86-64 kernel system-call functionality in Xen 4
osv·2012-06-12·CVSS 7.2
CVE-2012-0217 [HIGH] CVE-2012-0217: The x86-64 kernel system-call functionality in Xen 4
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of t
No detection rules found.
Exploit-DB
FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)
exploitdb·2019-03-07
CVE-2012-0217 FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)
FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'FreeBSD Intel SYSRET Privilege Escalation',
'Description' => %q{
This module exploits a vulnerability in the FreeBSD kernel,
when running on 64-bit Intel processors.
By design, 64-bit processors following the X86-64 specification will
trigger a general protection fault (GPF) when executing a SYSRET
instruction with a non-canonical address in the RCX register.
However, Intel processors check for a non-canonical address prior to
dropping privileges, causing a GPF in privileged mode. As a result,
the current userland RSP stack pointer is restored and executed,
resultin
Exploit-DB
FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation
exploitdb·2013-10-04
CVE-2012-0217 FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation
FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation
---
/*
* FreeBSD 9.0 Intel SYSRET Kernel Privilege Escalation exploit
* Author by CurcolHekerLink
*
* This exploit based on open source project, I can make it open source too. Right?
*
* If you blaming me for open sourcing this exploit, you can fuck your mom. Free of charge :)
*
* Credits to KEPEDEAN Corp, Barisan Sakit Hati, ora iso sepaying meneh hekerlink,
* Kismin perogeremer cyber team, petboylittledick, 1337 Curhat Crew and others at #MamaDedehEliteCurhatTeam
* if you would like next private exploit leakage, just mention @MamahhDedeh
*
* Some people may feel harmed when we release this exploit :))
*
* p.s: Met idul Adha ya besok, saatnya potong leher dewa lo... eh maksudnya potong Sapisisasi :))
*
*/
#include
#include
#include
Exploit-DB
Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042)
exploitdb·2012-08-27
CVE-2012-0217 Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042)
Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042)
---
Source: http://packetstormsecurity.org/files/115908/sysret.rar
This is proof of concept code that demonstrates the Microsoft Windows kernel (Intel/x64) SYSRET vulnerability as described in MS12-042. The shellcode disables code signing and will grant NT SYSTEM privileges to a specified application or already running process.
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20861.rar
Metasploit
FreeBSD Intel SYSRET Privilege Escalation
metasploit
FreeBSD Intel SYSRET Privilege Escalation
FreeBSD Intel SYSRET Privilege Escalation
This module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit Intel processors. By design, 64-bit processors following the X86-64 specification will trigger a general protection fault (GPF) when executing a SYSRET instruction with a non-canonical address in the RCX register. However, Intel processors check for a non-canonical address prior to dropping privileges, causing a GPF in privileged mode. As a result, the current userland RSP stack pointer is restored and executed, resulting in privileged code execution. This module has been tested successfully on: FreeBSD 8.3-RELEASE (amd64); and FreeBSD 9.0-RELEASE (amd64).
http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.aschttp://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.htmlhttp://lists.xen.org/archives/html/xen-devel/2012-06/msg01072.htmlhttp://secunia.com/advisories/55082http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.aschttp://security.gentoo.org/glsa/glsa-201309-24.xmlhttp://smartos.org/2012/06/15/smartos-news-3/http://support.citrix.com/article/CTX133161http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012http://www.debian.org/security/2012/dsa-2501http://www.debian.org/security/2012/dsa-2508http://www.kb.cert.org/vuls/id/649219http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlhttp://www.us-cert.gov/cas/techalerts/TA12-164A.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=813428https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15596https://www.exploit-db.com/exploits/28718/https://www.exploit-db.com/exploits/46508/https://www.illumos.org/issues/2873http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.aschttp://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.htmlhttp://lists.xen.org/archives/html/xen-devel/2012-06/msg01072.htmlhttp://secunia.com/advisories/55082http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.aschttp://security.gentoo.org/glsa/glsa-201309-24.xmlhttp://smartos.org/2012/06/15/smartos-news-3/http://support.citrix.com/article/CTX133161http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012http://www.debian.org/security/2012/dsa-2501http://www.debian.org/security/2012/dsa-2508http://www.kb.cert.org/vuls/id/649219http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlhttp://www.us-cert.gov/cas/techalerts/TA12-164A.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=813428https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15596https://www.exploit-db.com/exploits/28718/https://www.exploit-db.com/exploits/46508/https://www.illumos.org/issues/2873
2012-06-12
Published