illumos zonestatd CVE-2026-104116

Requires a local, authenticated (PR:L) account in any zone on an illumos-based host (illumos-gate or OmniOS) running zonestatd, the default zones statistics daemon; the zonestatd door is accessible to all users in every zone by default, so no special configuration is needed to reach the vulnerable ZSD_CMD_NEW_ZONE handler. Exploitation is LIMITED to hosts running affected versions (prior to illumos-gate commit 865b58d2), requires local access rather than network access, and yields only transient zonestat disruption and a zone-existence timing oracle - not persistence, privilege gain, or data theft. Multi-tenant deployments where untrusted users hold zone-local accounts are the realistic exposure; single-tenant or single-admin hosts face negligible risk.

This is a low-priority, low-real-risk issue despite being a genuine authorization flaw. All signals align toward minor impact: the vendor CVSS 4.0 score is 1.9 (Low), the vector is local (AV:L) with low attack complexity and requires some privileges (PR:L - i.e. an authenticated local account in any zone), and the impact metrics are confined to low confidentiality and low availability (VC:L/VI:N/VA:L) with no scope/subsequent-system impact (SC:N/SI:N/SA:N). CWE-862 (Missing Authorization) matches the description precisely: zsd_server() handles ZSD_CMD_NEW_ZONE without checking caller credentials. The CVSS 4.0 exploit-maturity metric E:P indicates proof-of-concept-level exploitability rather than active exploitation; there is no CISA KEV listing and no EPSS score provided, so widespread opportunistic exploitation is not indicated. The realistic worst case is transient denial of zonestat service in a target zone plus an information-disclosure side channel (timing reveals whether a zone ID is running) - not code execution, privilege escalation, or data compromise. No signals conflict: the local vector, low privileges, and low impact are mutually consistent. Net: a legitimate defense-in-depth fix for multi-tenant illumos/OmniOS operators, but not an urgent patch for most environments.

An unprivileged local user inside any zone on a shared illumos/OmniOS host connects to the globally-accessible zonestatd door and sends a ZSD_CMD_NEW_ZONE command with an arbitrary target zone ID, which zonestatd processes without verifying the caller came from the global zone with PRIV_SYS_CONFIG. This forces zonestatd to re-create its door file in the targeted zone, causing concurrent zonestat requests there to fail while the file is replaced, and the command's response timing also lets the attacker enumerate which zone IDs correspond to running zones. The flaw is proof-of-concept level (CVSS E:P) and requires only a local authenticated account, but exploitation is entirely local with low privileges.