CVE-2012-0217 The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent Sma...
- Published
- Updated
- Exploit status
- Public exploit available
Description
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xen(Debian:12) | < 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 |
| debian/xen(Debian:13) | < 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 |
| debian/xen(Debian:14) | < 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 |
| freebsd | <= 9.0 | No fix listed |
| illumos | <= r13723 | No fix listed |
| joyent smartos | <= 20120614 | No fix listed |
| Xen | <= 4.1.2 | No fix listed |
| Xen | = 4.0.0 | No fix listed |
| Xen | = 4.0.1 | No fix listed |
| Xen | = 4.0.2 | No fix listed |
| Xen | = 4.0.3 | No fix listed |
| Xen | = 4.0.4 | No fix listed |
| Xen | = 4.1.0 | No fix listed |
| Xen | = 4.1.1 | No fix listed |
| Microsoft windows 7 | All versions | No fix listed |
| Microsoft windows server 2003 | All versions | No fix listed |
| Microsoft windows server 2008 | = r2 | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
| citrix xenserver | <= 6.0.2 | No fix listed |
| citrix xenserver | = 6.0 | No fix listed |
| netbsd | <= 6.0 | No fix listed |
| sunos | <= 5.11 | No fix listed |
References
- Debian Security Tracker CVE-2012-0217 vendor-advisory
- blog.illumos.org
- blog.xen.org
- NetBSD-SA2012-003 vendor-advisory
- [xen-announce] 20120612 Xen Security Advisory 7 (CVE-2012-0217) - PV privilege escalation mailing-list
- [xen-devel] 20120619 Security vulnerability process, and CVE-2012-0217 mailing-list
- 55082 third-party-advisory
- FreeBSD-SA-12:04 vendor-advisory
- GLSA-201309-24 vendor-advisory
- smartos.org
- support.citrix.com
- wiki.smartos.org
- DSA-2501 vendor-advisory
- DSA-2508 vendor-advisory
- VU#649219 third-party-advisory us-government-resource
- MDVSA-2013:150 vendor-advisory
- www.oracle.com
- TA12-164A third-party-advisory us-government-resource
- bugzilla.redhat.com
- MS12-042 vendor-advisory
- oval:org.mitre.oval:def:15596 signature vdb-entry
- 28718 exploit
- 46508 exploit
- www.illumos.org