CVE-2012-0217: Citrix Xenserver

High severity, CVSS 7.2. EPSS: 39.8% chance of exploitation in the next 30 days.

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Affected products

• Citrix Xenserver: up to and including 6.0.2; version 6.0 only
• Freebsd Freebsd: up to and including 9.0
• Illumos Illumos: up to and including r13723
• Joyent Smartos: up to and including 20120614
• Microsoft Windows 7: any version
• Microsoft Windows Server 2003: any version
• Microsoft Windows Server 2008: version r2 only
• Microsoft Windows XP: any version
• Netbsd Netbsd: up to and including 6.0
• Sun Sunos: up to and including 5.11
• Xen Xen: up to and including 4.1.2; version 4.0.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only; …

Published 2012-06-12. Last modified 2026-06-16.