we track for your security since 1999

vulnerabilities

The Vigil@nce team watches vulnerabilities impacting your computers, and then offers solutions, a database and tools to correct them.

recent vulnerabilities

tracked products

RSS feed

vulnerability

vulnerability bulletin CVE-2012-0217

Xen, Citrix XenServer, BSD, Windows: privilege elevation in PV 64 bit Intel

Synthesis of the vulnerability

An administrator in a guest ParaVirtualized 64 bit system can use the SYSRET instruction with an invalid RIP, in order to execute code on the host system with a 64 bit Intel processor.
Impacted products: XenServer, Debian, Fedora, FreeBSD, Windows 2003, Windows 2008, Windows 7, Windows XP, NetBSD, openSUSE, RHEL, SUSE Linux Enterprise Desktop, SLES, Unix (platform).
Severity: 2/4.
Creation date: 12/06/2012.
Revisions dates: 12/06/2012, 13/06/2012.
Identifiers: 2711167, CERTA-2012-AVI-328, CERTA-2012-AVI-334, CTX133161, CVE-2012-0217, DSA 2501-1, DSA 2508-1, FEDORA-2012-9386, FEDORA-2012-9399, FEDORA-2012-9430, FreeBSD-SA-12:04.sysret, MS12-042, NetBSD-SA2012-003, openSUSE-SU-2012:0886-1, RHSA-2012:0720-01, RHSA-2012:0721-01, SUSE-SU-2012:0730-1, VIGILANCE-VUL-11693, VU#649219, XSA-7, XSA-8.

Description of the vulnerability

The SYSCALL/SYSRET assembler instruction is used to manage the enter and the return from a system call.

The RIP 64 bit register indicates the instruction pointer (the address which contains the code to execute).

A 64 bit processor uses "canonical" virtual addresses located between 0 and 0x7FFF FFFF FFFF ((1<<47) - 1) (for the low part).

However, an attacker can store a SYSCALL instruction at address (1<<47)-2, and then skip to this address. During the SYSRET call, the address of the next instruction becomes (1<<47), which is not canonical anymore. A General Protection Fault thus occurs, and data located at the RSP (Stack Pointer) address are overwritten by values stored in registers.

An administrator in a guest ParaVirtualized 64 bit system can therefore use the SYSRET instruction with an invalid RIP, in order to execute code on the host system with a 64 bit Intel processor.
Complete Vigil@nce bulletin.... (free access)

Share this bulletin

Computer vulnerabilities tracking service

Vigil@nce provides a software vulnerability announce. The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system. The technology watch team tracks security threats targeting the computer system. Each administrator can customize the list of products for which he wants to receive vulnerability alerts.