EUVD-2026-45034
GHSA-5jqp-7hrf-w792
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Race condition requires winning a kernel TOCTOU timing window (AC:H); low-privilege local account suffices (PR:L); kernel heap corruption enables scope change beyond the user process boundary (S:C).
Primary rating from Vendor (illumos).
CVSS VectorVendor: illumos
Lifecycle Timeline
3DescriptionCVE.org
A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_ioc_macprop_t ioctl header in once to read its pr_valsize field, sizes and allocates a kernel heap buffer from that value, and then copies the full request in a second time from the same unprivileged user address. A concurrent thread can enlarge pr_valsize between the two copyins, so the second copyin and the subsequent property handling write beyond the end of the undersized allocation and corrupt the kernel heap. An unprivileged local user, including one confined to a non-global zone that owns a datalink, can trigger this to panic the system. The resulting kernel heap corruption may be usable for further compromise.
AnalysisAI
Kernel heap corruption in the illumos data-link pseudo-driver (dld) allows an unprivileged local user - including one confined to a non-global zone that owns a datalink - to panic the system or potentially escalate privileges. The flaw in drv_ioc_prop_common() exploits a classic double-copyin TOCTOU race on the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls: the kernel sizes its heap allocation from pr_valsize on the first copyin but re-reads the entire ioctl struct from the same user address a second time, allowing a concurrent thread to enlarge pr_valsize between the two reads and overflow the under-sized buffer. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the upstream fix is confirmed by an illumos-gate commit.
Technical ContextAI
The vulnerable function is drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c, which services DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld, the illumos kernel data-link management device. The dld_ioc_macprop_t structure contains a fixed header (including the pr_valsize field) followed by a variable-length pr_val payload. CWE-367 (TOCTOU Race Condition) is the root cause: the driver calls ddi_copyin() once for sizeof(dld_ioc_macprop_t) to read pr_valsize, computes dsize = sizeof(dld_ioc_macprop_t) + pr_valsize - 1, allocates a kernel heap buffer of that size, then calls ddi_copyin() a second time for the full dsize bytes from the same user-space address. Because user memory can be modified between any two kernel reads, a racing write to pr_valsize after the allocation but before the second copyin causes the kernel to copy more bytes than were allocated. The fix (commit 6959feb5b430411a4809b06c53dcdb42fb525eac) eliminates the race by assigning the already-trusted in-kernel header copy (*kprop = *prop) and performing the second copyin only over the pr_val payload at the correct offset, so pr_valsize is never re-read from user space. A new DLD_MACPROP_BUFSIZE macro also corrects a size calculation error related to flexible-array-member padding. Affected CPEs are cpe:2.3:a:illumos:illumos-gate:*:*:*:*:*:*:*:*, cpe:2.3:a:omnios:omnios:*:*:*:*:*:*:*:*, and cpe:2.3:a:triton_data_center:smartos:*:*:*:*:*:*:*:*.
RemediationAI
The primary fix is available as illumos-gate commit 6959feb5b430411a4809b06c53dcdb42fb525eac (https://github.com/illumos/illumos-gate/commit/6959feb5b430411a4809b06c53dcdb42fb525eac); this is an upstream source commit rather than a tagged release, so the exact patched release version is not independently confirmed for illumos-gate, OmniOS, or SmartOS - administrators should monitor https://illumos.org/issues/18020 and their respective vendor release channels for downstream packages incorporating this change. As a compensating control where patching is not immediately feasible, restricting which zones receive datalink ownership via dlmgmtd and zone brand configuration eliminates the attack path for those zones: a non-global zone without datalink ownership cannot reach the DLDIOC_GETMACPROP or DLDIOC_SETMACPROP ioctl paths. The trade-off is that legitimate networking functionality requiring MAC-layer property access will be unavailable in those zones. There is no network-facing workaround because the attack vector is strictly local; network-layer firewall rules provide no mitigation.
More in Illumos Gate
View allRemote kernel heap corruption in the illumos SCTP stack lets an unauthenticated attacker send a crafted INIT ACK packet
illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today