CVE-2012-0217

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 39.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-12 · updated 2026-06-16
Weakness: CWE-119

Description

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Affected products

Citrix XenServer: through 6.0.2; 6.0 (and their updates)
FreeBSD: through 9.0
Illumos: through r13723
Joyent SmartOS: through 20120614
Microsoft Windows 7: all versions
Microsoft Windows Server 2003: all versions
Microsoft Windows Server 2008: r2 (and their updates)
Microsoft Windows XP Service Pack 3: all versions
Netbsd: through 6.0
Sunos: through 5.11
xen: through 4.1.2; 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0 (+1) (and their updates)

References

Get alerted when CVE-2012-0217 or the next vulnerability affects your stack