{"uuid": "468df0b0-1530-4b3e-93e6-2c824d6410fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-0217", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/local/intel_sysret_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x64\", \"author\": [\"Rafal Wojtczuk\", \"John Baldwin\", \"iZsh\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in the FreeBSD kernel,\\n          when running on 64-bit Intel processors.\\n\\n          By design, 64-bit processors following the X86-64 specification will\\n          trigger a general protection fault (GPF) when executing a SYSRET\\n          instruction with a non-canonical address in the RCX register.\\n\\n          However, Intel processors check for a non-canonical address prior to\\n          dropping privileges, causing a GPF in privileged mode. As a result,\\n          the current userland RSP stack pointer is restored and executed,\\n          resulting in privileged code execution.\\n\\n          This module has been tested successfully on:\\n\\n          FreeBSD 8.3-RELEASE (amd64); and\\n          FreeBSD 9.0-RELEASE (amd64).\", \"disclosure_date\": \"2012-06-12\", \"fullname\": \"exploit/freebsd/local/intel_sysret_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:31 +0000\", \"name\": \"FreeBSD Intel SYSRET Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/exploits/freebsd/local/intel_sysret_priv_esc.rb\", \"platform\": \"BSD\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"freebsd/local/intel_sysret_priv_esc\", \"references\": [\"BID-53856\", \"CVE-2012-0217\", \"EDB-28718\", \"PACKETSTORM-113584\", \"URL-https://www.freebsd.org/security/patches/SA-12:04/sysret.patch\", \"URL-https://blog.xenproject.org/2012/06/13/the-intel-sysret-privilege-escalation/\", \"URL-https://github.com/iZsh/exploits/blob/master/stash/CVE-2012-0217-sysret/CVE-2012-0217-sysret_FreeBSD.c\", \"URL-https://fail0verflow.com/blog/2012/cve-2012-0217-intel-sysret-freebsd/\", \"URL-http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc\", \"URL-https://www.slideshare.net/nkslides/exploiting-the-linux-kernel-via-intels-sysret-implementation\"], \"rport\": null, \"session_types\": [\"shell\"], \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:18.557074Z"}