{"id":"CVE-2012-0217","aliases":["DEBIAN-CVE-2012-0217","DSA-2501-1","DSA-2508-1","EUVD-2012-0253","GHSA-q644-363q-jfmm","RHSA-2012:0720","RHSA-2012:0721","openSUSE-SU-2024:10196-1"],"status":"published","title":"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer...","description":"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.","severity":{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.39573,"percentile":0.98623,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2012-06-12T22:00:00Z","modified":"2026-10-23T17:47:38Z","exploits":[{"source":"metasploit","id":"exploit/freebsd/local/intel_sysret_priv_esc","title":"FreeBSD Intel SYSRET Privilege Escalation","type":"exploit","platform":"BSD","date":"2012-06-12","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/freebsd/local/intel_sysret_priv_esc"},{"source":"exploitdb","id":"EDB-20861","title":"Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042)","type":"local","platform":"windows_x86-64","date":"2012-08-27","verified":true,"url":"https://www.exploit-db.com/exploits/20861"},{"source":"exploitdb","id":"EDB-28718","title":"FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation","type":"local","platform":"freebsd","date":"2013-10-04","verified":true,"url":"https://www.exploit-db.com/exploits/28718"},{"source":"exploitdb","id":"EDB-46508","title":"FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)","type":"local","platform":"freebsd_x86-64","date":"2019-03-07","verified":true,"url":"https://www.exploit-db.com/exploits/46508"}],"fixes":[{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.1.3~rc1+hg-20120614.a9c0a89c08f2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.1.3~rc1+hg-20120614.a9c0a89c08f2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.1.3~rc1+hg-20120614.a9c0a89c08f2-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"kfreebsd-8","fixed_in":["8.1+dfsg-8+squeeze3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3~rc1+hg-20120614.a9c0a89c08f2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3~rc1+hg-20120614.a9c0a89c08f2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3~rc1+hg-20120614.a9c0a89c08f2-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-5.2"}]}],"versions":["4.0.1-2","4.0.1-4","4.0.1-5","4.0.1-5.1"],"bundled":3},{"source":"osv","ecosystem":"Debian:6.0","package":"kfreebsd-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1+dfsg-8+squeeze3"}]}],"versions":["8.1+dfsg-7.1","8.1+dfsg-8","8.1+dfsg-8+squeeze1","8.1+dfsg-8+squeeze2"]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-PAE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-PAE-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-PAE-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-kdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-kdump-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-kdump-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.6","package":"kernel-xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-238.39.1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-PAE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-PAE-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-PAE-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-PAE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-PAE-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-PAE-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-kdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-kdump-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-kdump-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-308.8.2.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0_12-1.3"}]}],"bundled":124}],"products":[{"vendor":"citrix","product":"xenserver"},{"vendor":"freebsd","product":"freebsd"},{"vendor":"illumos","product":"illumos"},{"vendor":"joyent","product":"smartos"},{"vendor":"microsoft","product":"windows_7"},{"vendor":"microsoft","product":"windows_server_2003"},{"vendor":"microsoft","product":"windows_server_2008"},{"vendor":"microsoft","product":"windows_xp"},{"vendor":"netbsd","product":"netbsd"},{"vendor":"sun","product":"sunos"},{"vendor":"xen","product":"xen"}],"references":[{"url":"http://secunia.com/advisories/55082","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA12-164A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","US Government Resource","web"]},{"url":"http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042","tags":["vendor-advisory","x_refsource_MS","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/28718/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=813428","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.asc","tags":["vendor-advisory","x_refsource_NETBSD","x_transferred","advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-201309-24.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15596","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://www.debian.org/security/2012/dsa-2501","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"https://www.illumos.org/issues/2873","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.xen.org/archives/html/xen-devel/2012-06/msg01072.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.debian.org/security/2012/dsa-2508","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://support.citrix.com/article/CTX133161","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/46508/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://smartos.org/2012/06/15/smartos-news-3/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.kb.cert.org/vuls/id/649219","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0217","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/28718"},{"url":"https://www.exploit-db.com/exploits/46508"},{"url":"http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched"},{"url":"http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation"},{"url":"http://smartos.org/2012/06/15/smartos-news-3"},{"url":"https://github.com/advisories/GHSA-q644-363q-jfmm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-0217","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2012:0720","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=752304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=817570","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0720.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-0217","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-0217","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-1583","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-1583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1583","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2012:0721","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=824966","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0721.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-2934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-2934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2934","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7094","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-0217","description":"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.","status":"published","published":"2012-06-12T22:00:00Z","modified":"2024-08-06T18:16:19.831Z","updated_at":"2026-11-02T14:34:52.638543Z"}],"euvd":[{"id":"EUVD-2012-0253","description":"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.","status":"published","published":"2012-06-12T22:00:00Z","modified":"2024-08-06T18:16:19Z","updated_at":"2026-11-03T01:56:22.151365Z"}],"ghsa":[{"id":"GHSA-q644-363q-jfmm","title":"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer...","description":"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.","status":"published","published":"2022-05-04T00:28:51Z","modified":"2025-04-11T03:59:22Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:11.088321Z"}],"nvd":[{"id":"CVE-2012-0217","description":"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.","status":"published","published":"2012-06-12T22:55:01.343Z","modified":"2026-06-16T23:36:54.693Z","cvss":[{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:14.336529Z"}],"osv":[{"id":"CVE-2012-0217","description":"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.","status":"published","published":"2012-06-12T22:55:01Z","modified":"2026-04-10T03:42:10.726201Z","updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2012-0217","description":"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.","status":"published","published":"2012-06-12T22:55:01.343Z","modified":"2026-10-23T17:47:38.534373436Z","updated_at":"2026-11-02T15:45:24.92418Z"},{"id":"DSA-2501-1","title":"xen - several","status":"published","published":"2012-06-24T00:00:00Z","modified":"2026-03-09T01:19:53.414263Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"DSA-2508-1","title":"kfreebsd-8 - privilege escalation","status":"published","published":"2012-07-08T00:00:00Z","modified":"2026-03-09T01:19:59.489909Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"openSUSE-SU-2024:10196-1","title":"xen-4.7.0_12-1.3 on GA media","description":"These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:39.408456Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2012:0720","title":"Red Hat Security Advisory: kernel security and bug fix update","status":"published","published":"2024-09-15T19:55:01Z","modified":"2026-06-28T10:06:12Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2012:0721","title":"Red Hat Security Advisory: kernel security update","status":"published","published":"2024-09-15T19:55:06Z","modified":"2026-06-26T12:21:41.871624516Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}