exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 8 of 8 RSS Feed

CVE-2012-0217

Status Candidate

Overview

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Related Files

FreeBSD Intel SYSRET Privilege Escalation
Posted Mar 7, 2019
Authored by Rafal Wojtczuk, Brendan Coles, John Baldwin, iZsh | Site metasploit.com

This Metasploit module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit Intel processors. By design, 64-bit processors following the X86-64 specification will trigger a general protection fault (GPF) when executing a SYSRET instruction with a non-canonical address in the RCX register. However, Intel processors check for a non-canonical address prior to dropping privileges, causing a GPF in privileged mode. As a result, the current userland RSP stack pointer is restored and executed, resulting in privileged code execution.

tags | exploit, x86, kernel, code execution
systems | freebsd, bsd
advisories | CVE-2012-0217
SHA-256 | f1711c3320d7c4e9f80661d007057fb1b0b673f47fb51ec2968a821bc6aa8991
Gentoo Linux Security Advisory 201309-24
Posted Sep 27, 2013
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201309-24 - Multiple vulnerabilities have been found in Xen, allowing attackers on a Xen Virtual Machine to execute arbitrary code, cause Denial of Service, or gain access to data on the host. Versions less than 4.2.2-r1 are affected.

tags | advisory, denial of service, arbitrary, vulnerability
systems | linux, gentoo
advisories | CVE-2011-2901, CVE-2011-3262, CVE-2011-3262, CVE-2012-0217, CVE-2012-0218, CVE-2012-2934, CVE-2012-3432, CVE-2012-3433, CVE-2012-3494, CVE-2012-3495, CVE-2012-3496, CVE-2012-3497, CVE-2012-3498, CVE-2012-3515, CVE-2012-4411, CVE-2012-4535, CVE-2012-4536, CVE-2012-4537, CVE-2012-4538, CVE-2012-4539, CVE-2012-5510, CVE-2012-5511, CVE-2012-5512, CVE-2012-5513, CVE-2012-5514, CVE-2012-5515, CVE-2012-5525, CVE-2012-5634
SHA-256 | 42fbd346dc4e79100c814835fd5068ef0a6bd2ccc23977307e7f191f8be1cc22
Microsoft Windows Kernel Intel x64 SYSRET Proof Of Concept
Posted Aug 26, 2012
Authored by Shahriyar Jalayeri | Site repret.wordpress.com

This is proof of concept code that demonstrates the Microsoft Windows kernel (Intel/x64) SYSRET vulnerability as described in MS12-042. The shellcode disables code signing and will grant NT SYSTEM privileges to a specified application or already running process.

tags | exploit, kernel, shellcode, proof of concept
systems | windows
advisories | CVE-2012-0217
SHA-256 | 55e5a8e72dbb887b38dad0ce6c7bebe03b8466705cf04ce1a1a8c9406a8c4db3
Debian Security Advisory 2508-1
Posted Jul 23, 2012
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2508-1 - Rafal Wojtczuk from Bromium discovered that FreeBSD wasn't handling correctly uncanonical return addresses on Intel amd64 CPUs, allowing privilege escalation to kernel for local users.

tags | advisory, kernel, local
systems | linux, freebsd, debian
advisories | CVE-2012-0217
SHA-256 | 7aebd5ce5840f094d51d7679c7d9ff0704d0af681bb872fa59cd27000b552673
Debian Security Advisory 2501-1
Posted Jun 24, 2012
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2501-1 - Several vulnerabilities were discovered in Xen, a hypervisor.

tags | advisory, vulnerability
systems | linux, debian
advisories | CVE-2012-0217, CVE-2012-0218, CVE-2012-2934
SHA-256 | aedc2dcb40c8f0ac3825bb16ea9ed2fab49038c45013687c7f01466444984580
FreeBSD Security Advisory - Kernel Privilege Escalation
Posted Jun 12, 2012
Authored by Rafal Wojtczuk, John Baldwin | Site security.freebsd.org

FreeBSD Security Advisory - The FreeBSD operating system implements a rings model of security, where privileged operations are done in the kernel, and most applications request access to these operations by making a system call, which puts the CPU into the required privilege level and passes control to the kernel. FreeBSD/amd64 runs on CPUs from different vendors. Due to varying behaviour of CPUs in 64 bit mode a sanity check of the kernel may be insufficient when returning from a system call. Successful exploitation of the problem can lead to local kernel privilege escalation, kernel data corruption and/or crash.

tags | advisory, kernel, local
systems | freebsd
advisories | CVE-2012-0217
SHA-256 | 50ab73e18c85232ccd993cef89e2d46586aa4f827d36aa88ad33256fe4a53d2d
Red Hat Security Advisory 2012-0720-01
Posted Jun 12, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0720-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the Xen hypervisor implementation as shipped with Red Hat Enterprise Linux 5 did not properly restrict the syscall return addresses in the sysret return path to canonical addresses. An unprivileged user in a 64-bit para-virtualized guest, that is running on a 64-bit host that has an Intel CPU, could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the hypervisor level.

tags | advisory, arbitrary, kernel
systems | linux, redhat
advisories | CVE-2012-0217, CVE-2012-1583
SHA-256 | 4f93a8d3609af7b9395a9788c9a833f81f3cf75349cf85a1cb8f625a117d6395
Red Hat Security Advisory 2012-0721-01
Posted Jun 12, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0721-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the Xen hypervisor implementation as shipped with Red Hat Enterprise Linux 5 did not properly restrict the syscall return addresses in the sysret return path to canonical addresses. An unprivileged user in a 64-bit para-virtualized guest, that is running on a 64-bit host that has an Intel CPU, could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the hypervisor level.

tags | advisory, arbitrary, kernel
systems | linux, redhat
advisories | CVE-2012-0217, CVE-2012-2934
SHA-256 | a5b7f699084429bb0df03f79e3c77c3fe4d64db427a8e5ac1c2e51801bd8f6fe
Page 1 of 1
Back1Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close