$ cve CVE-2012-0217 JSON

CVE-2012-0217 EXPLOIT

7.2

HIGH · CVSS 2.0 · EPSS 39.8% (pctl 99)

Patch early

A public exploit exists.

Description

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Scoring

CVSS	7.2 (HIGH, v2.0)
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C
EPSS	39.84% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2012-06-12
Last modified	2026-06-16

Affected (11)

Vendor	Product
citrix	xenserver
freebsd	freebsd
illumos	illumos
joyent	smartos
microsoft	windows 7
microsoft	windows server 2003
microsoft	windows server 2008
microsoft	windows xp
netbsd	netbsd
sun	sunos
xen	xen

Public exploits

Source	Title	Date
exploit-db	FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)	2019-03-07
exploit-db	FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation	2013-10-04
exploit-db	Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042)	2012-08-27

References

→ the Explorer · watch your stack · NVD