vulnerability bulletin CVE-2012-0217
Xen, Citrix XenServer, BSD, Windows: privilege elevation in PV 64 bit Intel
Synthesis of the vulnerability
An administrator in a guest ParaVirtualized 64 bit system can use the SYSRET instruction with an invalid RIP, in order to execute code on the host system with a 64 bit Intel processor.Impacted products:
XenServer, Debian, Fedora, FreeBSD, Windows 2003, Windows 2008, Windows 7, Windows XP, NetBSD, openSUSE, RHEL, SUSE Linux Enterprise Desktop, SLES, Unix (platform).
2711167, CERTA-2012-AVI-328, CERTA-2012-AVI-334, CTX133161, CVE-2012-0217, DSA 2501-1, DSA 2508-1, FEDORA-2012-9386, FEDORA-2012-9399, FEDORA-2012-9430, FreeBSD-SA-12:04.sysret, MS12-042, NetBSD-SA2012-003, openSUSE-SU-2012:0886-1, RHSA-2012:0720-01, RHSA-2012:0721-01, SUSE-SU-2012:0730-1, VIGILANCE-VUL-11693, VU#649219, XSA-7, XSA-8.
Description of the vulnerability
The SYSCALL/SYSRET assembler instruction is used to manage the enter and the return from a system call.
The RIP 64 bit register indicates the instruction pointer (the address which contains the code to execute).
A 64 bit processor uses "canonical" virtual addresses located between 0 and 0x7FFF FFFF FFFF ((1<<47) - 1) (for the low part).
However, an attacker can store a SYSCALL instruction at address (1<<47)-2, and then skip to this address. During the SYSRET call, the address of the next instruction becomes (1<<47), which is not canonical anymore. A General Protection Fault thus occurs, and data located at the RSP (Stack Pointer) address are overwritten by values stored in registers.
An administrator in a guest ParaVirtualized 64 bit system can therefore use the SYSRET instruction with an invalid RIP, in order to execute code on the host system with a 64 bit Intel processor.Complete Vigil@nce bulletin....
Share this bulletin
Computer vulnerabilities tracking service
Vigil@nce provides a software vulnerability announce
. The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system. The technology watch team tracks security threats targeting the computer system. Each administrator can customize the list of products for which he wants to receive vulnerability alerts.