{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-06-12T00:00:00", "descriptions": [{"lang": "en", "value": "The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-03-08T10:57:01", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"name": "55082", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/55082"}, {"name": "TA12-164A", "tags": ["third-party-advisory", "x_refsource_CERT"], "url": "http://www.us-cert.gov/cas/techalerts/TA12-164A.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/"}, {"name": "MS12-042", "tags": ["vendor-advisory", "x_refsource_MS"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042"}, {"name": "28718", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/28718/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=813428"}, {"name": "NetBSD-SA2012-003", "tags": ["vendor-advisory", "x_refsource_NETBSD"], "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.asc"}, {"name": "GLSA-201309-24", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"}, {"name": "oval:org.mitre.oval:def:15596", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15596"}, {"name": "DSA-2501", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2012/dsa-2501"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.illumos.org/issues/2873"}, {"name": "[xen-devel] 20120619 Security vulnerability process, and CVE-2012-0217", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.xen.org/archives/html/xen-devel/2012-06/msg01072.html"}, {"name": "DSA-2508", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2012/dsa-2508"}, {"name": "[xen-announce] 20120612 Xen Security Advisory 7 (CVE-2012-0217) - PV privilege escalation", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://support.citrix.com/article/CTX133161"}, {"name": "46508", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/46508/"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://smartos.org/2012/06/15/smartos-news-3/"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012"}, {"name": "VU#649219", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/649219"}, {"name": "MDVSA-2013:150", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}, {"name": "FreeBSD-SA-12:04", "tags": ["vendor-advisory", "x_refsource_FREEBSD"], "url": "http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "ID": "CVE-2012-0217", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "55082", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/55082"}, {"name": "TA12-164A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA12-164A.html"}, {"name": "http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/", "refsource": "CONFIRM", "url": "http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/"}, {"name": "MS12-042", "refsource": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042"}, {"name": "28718", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/28718/"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=813428", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=813428"}, {"name": "NetBSD-SA2012-003", "refsource": "NETBSD", "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.asc"}, {"name": "GLSA-201309-24", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"}, {"name": "oval:org.mitre.oval:def:15596", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15596"}, {"name": "DSA-2501", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2012/dsa-2501"}, {"name": "http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/", "refsource": "CONFIRM", "url": "http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/"}, {"name": "https://www.illumos.org/issues/2873", "refsource": "CONFIRM", "url": "https://www.illumos.org/issues/2873"}, {"name": "[xen-devel] 20120619 Security vulnerability process, and CVE-2012-0217", "refsource": "MLIST", "url": "http://lists.xen.org/archives/html/xen-devel/2012-06/msg01072.html"}, {"name": "DSA-2508", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2012/dsa-2508"}, {"name": "[xen-announce] 20120612 Xen Security Advisory 7 (CVE-2012-0217) - PV privilege escalation", "refsource": "MLIST", "url": "http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html"}, {"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"}, {"name": "http://support.citrix.com/article/CTX133161", "refsource": "CONFIRM", "url": "http://support.citrix.com/article/CTX133161"}, {"name": "46508", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/46508/"}, {"name": "http://smartos.org/2012/06/15/smartos-news-3/", "refsource": "CONFIRM", "url": "http://smartos.org/2012/06/15/smartos-news-3/"}, {"name": "http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012", "refsource": "CONFIRM", "url": "http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012"}, {"name": "VU#649219", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/649219"}, {"name": "MDVSA-2013:150", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}, {"name": "FreeBSD-SA-12:04", "refsource": "FREEBSD", "url": "http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T18:16:19.831Z"}, "title": "CVE Program Container", "references": [{"name": "55082", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/55082"}, {"name": "TA12-164A", "tags": ["third-party-advisory", "x_refsource_CERT", "x_transferred"], "url": "http://www.us-cert.gov/cas/techalerts/TA12-164A.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/"}, {"name": "MS12-042", "tags": ["vendor-advisory", "x_refsource_MS", "x_transferred"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042"}, {"name": "28718", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/28718/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=813428"}, {"name": "NetBSD-SA2012-003", "tags": ["vendor-advisory", "x_refsource_NETBSD", "x_transferred"], "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.asc"}, {"name": "GLSA-201309-24", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"}, {"name": "oval:org.mitre.oval:def:15596", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15596"}, {"name": "DSA-2501", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2012/dsa-2501"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.illumos.org/issues/2873"}, {"name": "[xen-devel] 20120619 Security vulnerability process, and CVE-2012-0217", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.xen.org/archives/html/xen-devel/2012-06/msg01072.html"}, {"name": "DSA-2508", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2012/dsa-2508"}, {"name": "[xen-announce] 20120612 Xen Security Advisory 7 (CVE-2012-0217) - PV privilege escalation", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://support.citrix.com/article/CTX133161"}, {"name": "46508", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/46508/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://smartos.org/2012/06/15/smartos-news-3/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012"}, {"name": "VU#649219", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/649219"}, {"name": "MDVSA-2013:150", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}, {"name": "FreeBSD-SA-12:04", "tags": ["vendor-advisory", "x_refsource_FREEBSD", "x_transferred"], "url": "http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc"}]}]}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2012-0217", "datePublished": "2012-06-12T22:00:00", "dateReserved": "2011-12-14T00:00:00", "dateUpdated": "2024-08-06T18:16:19.831Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F7B2CC9-2907-49AF-8497-CE60554123F4", "versionEndIncluding": "9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:illumos:illumos:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8F4D46A-B031-4639-AA94-5E44091F4B92", "versionEndIncluding": "r13723", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:joyent:smartos:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F2DF32E-26A0-4463-85DD-6E63C125E606", "versionEndIncluding": "20120614", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5037783-1819-4FC5-B7A7-EB80F6A98E1F", "versionEndIncluding": "4.1.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "550223A9-B9F1-440A-8C25-9F0F76AF7301", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "FC734D58-96E5-4DD2-8781-F8E0ADB96462", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "62CEC1BF-1922-410D-BCBA-C58199F574C7", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "923F2C2B-4A65-4823-B511-D0FEB7C7FAB2", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "C1A24DED-B2EC-4D9C-9FA4-DD37EF3E3BFC", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "0D532B60-C8DD-4A2F-9D05-E574D23EB754", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "5D83CA8B-8E49-45FA-8FAB-C15052474542", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_7:*:*:x64:*:*:*:*:*", "matchCriteriaId": "CE381783-027E-4B6D-B801-59873E5EA483", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*", "matchCriteriaId": "4FA15D65-7C32-4C7A-9915-746AB3F454EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*", "matchCriteriaId": "4D3B5E4F-56A6-4696-BBB4-19DF3613D020", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*", "matchCriteriaId": "95DC297F-06DB-4FB3-BFB6-7312C059E047", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*", "matchCriteriaId": "CE477A73-4EE4-41E9-8694-5A3D5DC88656", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:citrix:xenserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "24FCA867-7158-459C-9D6C-75A39263F00A", "versionEndIncluding": "6.0.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:citrix:xenserver:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "9C1D10B8-202D-44A4-A872-88D7C11488D1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netbsd:netbsd:*:beta:*:*:*:*:*:*", "matchCriteriaId": "D2AF9820-F982-4804-9580-78CDD4273C6B", "versionEndIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sun:sunos:*:*:*:*:*:*:*:*", "matchCriteriaId": "696972CD-A690-4DDC-A852-1253062AE874", "versionEndIncluding": "5.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier."}, {"lang": "es", "value": "El modo de usuario Scheduler en el n\u00facleo en Microsoft Windows Server v2008 R2 y R2 SP1 y Windows v7 Gold y SP1 sobre la plataforma x64 no maneja adecuadamente solicitudes del sistema, lo que permite a usuarios locales obtener privilegios a trav\u00e9s de una aplicaci\u00f3n modificada, tambi\u00e9n conocida como \"vulnerabilidad de corrupci\u00f3n de memoria de modo de usuario Scheduler\"."}], "evaluatorImpact": "Per: http://technet.microsoft.com/en-us/security/bulletin/ms12-042\n\n'This vulnerability only affects Intel x64-based versions of Windows 7 and Windows Server 2008 R2. Systems with AMD or ARM-based CPUs are not affected by this vulnerability.'", "id": "CVE-2012-0217", "lastModified": "2020-09-28T12:58:30.503", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-06-12T22:55:01.343", "references": [{"source": "security@debian.org", "url": "http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/"}, {"source": "security@debian.org", "url": "http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/"}, {"source": "security@debian.org", "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.asc"}, {"source": "security@debian.org", "url": "http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html"}, {"source": "security@debian.org", "url": "http://lists.xen.org/archives/html/xen-devel/2012-06/msg01072.html"}, {"source": "security@debian.org", "url": "http://secunia.com/advisories/55082"}, {"source": "security@debian.org", "url": "http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc"}, {"source": "security@debian.org", "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"}, {"source": "security@debian.org", "url": "http://smartos.org/2012/06/15/smartos-news-3/"}, {"source": "security@debian.org", "url": "http://support.citrix.com/article/CTX133161"}, {"source": "security@debian.org", "url": "http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012"}, {"source": "security@debian.org", "url": "http://www.debian.org/security/2012/dsa-2501"}, {"source": "security@debian.org", "url": "http://www.debian.org/security/2012/dsa-2508"}, {"source": "security@debian.org", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/649219"}, {"source": "security@debian.org", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}, {"source": "security@debian.org", "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"}, {"source": "security@debian.org", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA12-164A.html"}, {"source": "security@debian.org", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=813428"}, {"source": "security@debian.org", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042"}, {"source": "security@debian.org", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15596"}, {"source": "security@debian.org", "url": "https://www.exploit-db.com/exploits/28718/"}, {"source": "security@debian.org", "url": "https://www.exploit-db.com/exploits/46508/"}, {"source": "security@debian.org", "url": "https://www.illumos.org/issues/2873"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Xen project for reporting this issue. Upstream acknowledges Rafal Wojtczuk as the original reporter.", "affected_release": [{"advisory": "RHSA-2012:0721", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "kernel-0:2.6.18-308.8.2.el5", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2012-06-12T00:00:00Z"}, {"advisory": "RHSA-2012:0720", "cpe": "cpe:/o:redhat:rhel_eus:5.6", "package": "kernel-0:2.6.18-238.39.1.el5", "product_name": "Red Hat Enterprise Linux 5.6 EUS - Server Only", "release_date": "2012-06-12T00:00:00Z"}], "bugzilla": {"description": "kernel: x86-64: avoid sysret to non-canonical address", "id": "813428", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=813428"}, "csaw": false, "cvss": {"cvss_base_score": "7.9", "cvss_scoring_vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "status": "verified"}, "details": ["The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.", "It was found that the Xen hypervisor implementation as shipped with Red Hat Enterprise Linux 5 did not properly restrict the syscall return addresses in the sysret return path to canonical addresses. An unprivileged user in a 64-bit para-virtualized guest, that is running on a 64-bit host that has an Intel CPU, could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the hypervisor level."], "name": "CVE-2012-0217", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Affected", "package_name": "kernel-xen", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/a:redhat:enterprise_mrg:2", "fix_state": "Not affected", "package_name": "realtime-kernel", "product_name": "Red Hat Enterprise MRG 2"}], "public_date": "2012-06-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-0217\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-0217"], "statement": "This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and 6, and Red Hat Enterprise MRG, as those versions have a guard page between the end of the user-mode accessible virtual address space and the beginning of the non-canonical area due to CVE-2005-1764 fix, and hardened system call handler due to CVE-2006-0744 fix.\nThis issue did affect the versions of Xen hypervisor as shipped with Red Hat Enterprise Linux 5. A kernel-xen update for Red Hat Enterprise Linux 5 is available to address this flaw.", "threat_severity": "Important"}