Description
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | — |
| Debian 13 | xen | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | — |
| Debian 12 | xen | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | — |
| Debian 6.0 | kfreebsd-8 | 8.1+dfsg-8+squeeze3 | DSA-2508-1 |
| Debian 6.0 | xen | 4.0.1-5.2 | DSA-2501-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-308.8.2.el5 | RHSA-2012:0721 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5.6 EUS | kernel +12 | 2.6.18-238.39.1.el5 | RHSA-2012:0720 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 | openSUSE-SU-2024:10196-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
FreeBSD Intel SYSRET Privilege Escalation
exploit/freebsd/local/intel_sysret_priv_esc
Exploit-DB 3
- FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) EDB-46508 · local · Mar 7, 2019 · verified
- FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation EDB-28718 · local · Oct 4, 2013 · verified
- Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042) EDB-20861 · local · Aug 27, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2012:0720 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0721 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2508-1 kfreebsd-8 - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2501-1 xen - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10196-1 xen-4.7.0_12-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 55082 third-party-advisory
- TA12-164A third-party-advisory
- http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/
- MS12-042 vendor-advisory
- 28718 exploit
- https://bugzilla.redhat.com/show_bug.cgi?id=813428
- NetBSD-SA2012-003 vendor-advisory
- GLSA-201309-24 vendor-advisory
- oval:org.mitre.oval:def:15596 vdb-entry signature
- DSA-2501 vendor-advisory
- http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/
- https://www.illumos.org/issues/2873
- [xen-devel] 20120619 Security vulnerability process, and CVE-2012-0217 mailing-list
- DSA-2508 vendor-advisory
- [xen-announce] 20120612 Xen Security Advisory 7 (CVE-2012-0217) - PV privilege escalation mailing-list
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- http://support.citrix.com/article/CTX133161
- 46508 exploit
- http://smartos.org/2012/06/15/smartos-news-3/
- http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012
- VU#649219 third-party-advisory
- MDVSA-2013:150 vendor-advisory
- FreeBSD-SA-12:04 vendor-advisory