Every CVE Search/ Get API key

CVE-2012-0217

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer...

7.2 HighPublic exploitFix available

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Exploit likelihood

39.6%Up 36.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.2

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Record
CVE-2012-0217
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Record
CVE-2012-0217
Updated
2026-11-02
EUVDEUVD-2012-0253 No score

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Record
EUVD-2012-0253
Updated
2026-11-03
GitHub AdvisoriesGHSA-q644-363q-jfmm No score

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer...

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Record
GHSA-q644-363q-jfmm
Weakness
CWE-119
Updated
2026-11-02
OSV No score

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Record
CVE-2012-0217
Updated
2026-11-02
OSVDEBIAN-CVE-2012-0217 No score

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Record
DEBIAN-CVE-2012-0217
Updated
2026-11-02
OSVopenSUSE-SU-2024:10196-1 No score

xen-4.7.0_12-1.3 on GA media

These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10196-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xen
Debian:12
 before 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1
4.1.3~rc1+hg-20120614.a9c0a89c08f2-1
xen
Debian:13
 before 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1
4.1.3~rc1+hg-20120614.a9c0a89c08f2-1
xen
Debian:14
 before 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1
4.1.3~rc1+hg-20120614.a9c0a89c08f2-1
xen
Debian:6.0
From an advisory covering 3 CVEs
 before 4.0.1-5.2, plus listed versions
4.0.1-24.0.1-44.0.1-54.0.1-5.1
4.0.1-5.2
kfreebsd-8
Debian:6.0
 before 8.1+dfsg-8+squeeze3, plus listed versions
8.1+dfsg-7.18.1+dfsg-88.1+dfsg-8+squeeze18.1+dfsg-8+squeeze2
8.1+dfsg-8+squeeze3
kernel
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-PAE
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-PAE-debuginfo
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-PAE-devel
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-debug
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
Show 47 moreShow less
Affected packages
PackageAffectedFixed
kernel-debug-debuginfo
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-debug-devel
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-debuginfo
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-debuginfo-common
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-devel
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-doc
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-headers
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-kdump
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-kdump-debuginfo
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-kdump-devel
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-xen
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-xen-debuginfo
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel-xen-devel
Red Hat:rhel_eus:5.6
From an advisory covering 2 CVEs
 before 0:2.6.18-238.39.1.el5
0:2.6.18-238.39.1.el5
kernel
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-PAE
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-PAE-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-PAE-devel
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debug
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debug-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debug-devel
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debuginfo-common
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-devel
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-doc
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-headers
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-xen
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-xen-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-xen-devel
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-PAE
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-PAE-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-PAE-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debug
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debug-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debug-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-debuginfo-common
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-doc
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-headers
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-kdump
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-kdump-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-kdump-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-xen
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-xen-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
kernel-xen-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.6.18-308.8.2.el5
0:2.6.18-308.8.2.el5
xen
openSUSE:Tumbleweed
From an advisory covering 124 CVEs
 before 4.7.0_12-1.3
4.7.0_12-1.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitFreeBSD Intel SYSRET Privilege Escalation2012-06-12
Exploit-DBMicrosoft Windows Kernel - Intel x64 SYSRET (MS12-042)2012-08-27
Exploit-DBFreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation2013-10-04
Exploit-DBFreeBSD - Intel SYSRET Privilege Escalation (Metasploit)2019-03-07

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-0217 is a high vulnerability (CVSS 7.2) in Citrix Xenserver, published June 12, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 39.6%, the 98th percentile. Fixed in xen 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1.

References

Show 160 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open