CVE-2012-0217
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11...
- Published
- Jun 12, 2012
- Updated
- Aug 6, 2024
- Assigning CNA
- debian
- Evidence observed
- Aug 27, 2012
Primary CVSS
nvd · CVSS 2.0
AV:L/AC:L/Au:N/C:C/I:C/A:CModerate · next 30 days
- Percentile
- 98.6%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
Sources
modules/exploits/freebsd/local/intel_sysret_priv_esc.rb
Metasploit Framework modulesDeclared conditions
- platform: BSD($.exploit_freebsd/local/intel_sysret_priv_esc.platform)
- verification: check_declared($.exploit_freebsd/local/intel_sysret_priv_esc.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.