Illumos
Monthly
Remote kernel heap corruption in the illumos SCTP stack lets an unauthenticated attacker send a crafted INIT ACK packet with malformed address parameters to trigger an out-of-bounds access during packet classification, potentially leading to remote code execution or a kernel panic. The flaw affects illumos-gate and downstream distributions (OmniOS, SmartOS/Triton) built before commit 53a3efde, and has existed since 2010 (commit a5407c02). There is no public exploit identified at time of analysis and the CVSS 4.0 exploit-maturity metric is Unreported (E:U), but the attack requires no authentication or user interaction.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
Local denial of service in the illumos reparsed daemon (reparsed) lets a low-privileged authenticated local user crash the daemon and, through repeated requests, drive the svc:/system/filesystem/reparse service into maintenance. The bug is a stack buffer overflow (CWE-121) in the nfs-basic reparse plugin's get_fs_locations(), which copies attacker-supplied host and path components of a reparse string into a fixed 1024-byte stack buffer with no length validation, reachable because the door at /var/run/reparsed_door is world-readable and the door server does not verify caller credentials. Exploitation is availability-only on default builds (stack protection aborts the process rather than yielding code execution), no public exploit code has been identified at time of analysis, and the affected service is disabled by default, which substantially limits real-world exposure; this is a genuinely low-priority, availability-only issue despite the stack-based overflow classification.
NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows any local user to crash the daemon - and, by repeating the call, to drive the svc:/network/physical:nwam service into maintenance so automatic network configuration stops - by issuing a door_call() with no argument data to the world-accessible nwam_door at /etc/svc/volatile/nwam/nwam_door. Every illumos distribution built before illumos-gate commit 0f1064d97f1a43778ddf87d4e438b99872aed1a0 is affected (the flaw dates to the 2010 commit 6ba597c5), and OmniOS is explicitly named in the affected-product CPE data, though exposure is materially limited because nwamd only runs when svc:/network/physical:nwam is enabled, which is not the illumos default. Impact is availability-only (CVSS 4.0 base 5.4; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the CVSS 4.0 vector rates exploit maturity as Proof-of-Concept (E:P), while the issue is not in CISA KEV and no active exploitation is confirmed.
Kernel memory exhaustion in the illumos name service cache daemon (nscd) lets any local, unprivileged user - including one confined to a non-global zone - drive the daemon's file descriptor table to grow without bound. The nscd door at /var/run/name_service_door accepts passed file descriptors from any user in its zone, and switcher() in nscd_frontend.c never releases descriptors that a request does not consume, so a loop of door_call() invocations against the daemon slowly starves kernel memory and can render processes in every zone on the host unresponsive. Impact is availability-only with no confidentiality or integrity loss, and it is confirmed to affect illumos-gate and OmniOS builds predating illumos-gate commit af810a72, which caps in-flight descriptors and closes unused ones; no CISA KEV listing or public exploit code is documented in the supplied references, and the defect has been latent in the illumos codebase since a 2006 commit (cb5caa98).
Local users holding an unprivileged account in any zone on an illumos-based host can send an unauthorized ZSD_CMD_NEW_ZONE request to the zonestatd door, forcing the daemon to re-create its door file in an arbitrary zone so that new zonestat requests in that zone can fail while the file is replaced, and using the command's response timing as an oracle for whether a given zone ID is currently running. The root cause is a missing authorization check (CWE-862) in zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, a gap that has existed since illumos-gate commit efd4c9b6 in 2010 and affects illumos-gate and OmniOS builds prior to illumos-gate commit 865b58d2; a vendor fix is available, and no public exploit code was identified at time of analysis. Impact is confined to transient disruption of zone statistics collection plus a zone-existence oracle - no privilege gain, persistence, or data theft - so this is a low-priority issue for single-tenant or single-admin hosts and only a modest concern in multi-tenant deployments where untrusted users hold zone-local accounts.
Local unprivileged users on illumos distributions can silently alter the persistent IP multipathing (IPMP) configuration because the ipmgmtd door service fails to require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command. Rated only CVSS 4.0 1.9 (independent assessment CVSS 3.1 7.3-adjacent vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), the issue requires an existing local account on an illumos-gate derivative such as OmniOS built before commit e8d3efa1, and the modified state only takes effect when the stored ipadm configuration is next applied (typically at reboot), so impact is delayed and limited to integrity and availability of network configuration rather than immediate disruption. No CISA KEV listing is present; the CVSS 4.0 vector's E:P metric indicates proof-of-concept-level exploit maturity, meaning publicly available exploit code exists, and the flaw has been present since illumos-gate commit a73be61a in 2021.
Host denial-of-service in illumos bhyve allows a privileged guest user to panic the host by executing a REP-prefixed MOVS or STOS instruction targeting kernel-emulated MMIO regions such as the local APIC. The flaw has existed since 2020 and affects illumos-gate and OmniOS builds prior to commit 696ecf8d, stemming from a failure to clear the VIES_REPEAT flag that leads to a VERIFY assertion in vie_advance_pc(). Publicly available exploit code exists, but no active exploitation has been confirmed.
Kernel heap corruption in the illumos data-link pseudo-driver (dld) allows an unprivileged local user - including one confined to a non-global zone that owns a datalink - to panic the system or potentially escalate privileges. The flaw in drv_ioc_prop_common() exploits a classic double-copyin TOCTOU race on the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls: the kernel sizes its heap allocation from pr_valsize on the first copyin but re-reads the entire ioctl struct from the same user address a second time, allowing a concurrent thread to enlarge pr_valsize between the two reads and overflow the under-sized buffer. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the upstream fix is confirmed by an illumos-gate commit.
illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat on a long file name in /dev/net. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
illumos smbsrv NULL pointer dereference allows system crash. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The devzvol_readdir function in illumos does not check the return value of a strchr call, which allows remote attackers to cause a denial of service (NULL pointer dereference and panic) via. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote kernel heap corruption in the illumos SCTP stack lets an unauthenticated attacker send a crafted INIT ACK packet with malformed address parameters to trigger an out-of-bounds access during packet classification, potentially leading to remote code execution or a kernel panic. The flaw affects illumos-gate and downstream distributions (OmniOS, SmartOS/Triton) built before commit 53a3efde, and has existed since 2010 (commit a5407c02). There is no public exploit identified at time of analysis and the CVSS 4.0 exploit-maturity metric is Unreported (E:U), but the attack requires no authentication or user interaction.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
Local denial of service in the illumos reparsed daemon (reparsed) lets a low-privileged authenticated local user crash the daemon and, through repeated requests, drive the svc:/system/filesystem/reparse service into maintenance. The bug is a stack buffer overflow (CWE-121) in the nfs-basic reparse plugin's get_fs_locations(), which copies attacker-supplied host and path components of a reparse string into a fixed 1024-byte stack buffer with no length validation, reachable because the door at /var/run/reparsed_door is world-readable and the door server does not verify caller credentials. Exploitation is availability-only on default builds (stack protection aborts the process rather than yielding code execution), no public exploit code has been identified at time of analysis, and the affected service is disabled by default, which substantially limits real-world exposure; this is a genuinely low-priority, availability-only issue despite the stack-based overflow classification.
NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows any local user to crash the daemon - and, by repeating the call, to drive the svc:/network/physical:nwam service into maintenance so automatic network configuration stops - by issuing a door_call() with no argument data to the world-accessible nwam_door at /etc/svc/volatile/nwam/nwam_door. Every illumos distribution built before illumos-gate commit 0f1064d97f1a43778ddf87d4e438b99872aed1a0 is affected (the flaw dates to the 2010 commit 6ba597c5), and OmniOS is explicitly named in the affected-product CPE data, though exposure is materially limited because nwamd only runs when svc:/network/physical:nwam is enabled, which is not the illumos default. Impact is availability-only (CVSS 4.0 base 5.4; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the CVSS 4.0 vector rates exploit maturity as Proof-of-Concept (E:P), while the issue is not in CISA KEV and no active exploitation is confirmed.
Kernel memory exhaustion in the illumos name service cache daemon (nscd) lets any local, unprivileged user - including one confined to a non-global zone - drive the daemon's file descriptor table to grow without bound. The nscd door at /var/run/name_service_door accepts passed file descriptors from any user in its zone, and switcher() in nscd_frontend.c never releases descriptors that a request does not consume, so a loop of door_call() invocations against the daemon slowly starves kernel memory and can render processes in every zone on the host unresponsive. Impact is availability-only with no confidentiality or integrity loss, and it is confirmed to affect illumos-gate and OmniOS builds predating illumos-gate commit af810a72, which caps in-flight descriptors and closes unused ones; no CISA KEV listing or public exploit code is documented in the supplied references, and the defect has been latent in the illumos codebase since a 2006 commit (cb5caa98).
Local users holding an unprivileged account in any zone on an illumos-based host can send an unauthorized ZSD_CMD_NEW_ZONE request to the zonestatd door, forcing the daemon to re-create its door file in an arbitrary zone so that new zonestat requests in that zone can fail while the file is replaced, and using the command's response timing as an oracle for whether a given zone ID is currently running. The root cause is a missing authorization check (CWE-862) in zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, a gap that has existed since illumos-gate commit efd4c9b6 in 2010 and affects illumos-gate and OmniOS builds prior to illumos-gate commit 865b58d2; a vendor fix is available, and no public exploit code was identified at time of analysis. Impact is confined to transient disruption of zone statistics collection plus a zone-existence oracle - no privilege gain, persistence, or data theft - so this is a low-priority issue for single-tenant or single-admin hosts and only a modest concern in multi-tenant deployments where untrusted users hold zone-local accounts.
Local unprivileged users on illumos distributions can silently alter the persistent IP multipathing (IPMP) configuration because the ipmgmtd door service fails to require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command. Rated only CVSS 4.0 1.9 (independent assessment CVSS 3.1 7.3-adjacent vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), the issue requires an existing local account on an illumos-gate derivative such as OmniOS built before commit e8d3efa1, and the modified state only takes effect when the stored ipadm configuration is next applied (typically at reboot), so impact is delayed and limited to integrity and availability of network configuration rather than immediate disruption. No CISA KEV listing is present; the CVSS 4.0 vector's E:P metric indicates proof-of-concept-level exploit maturity, meaning publicly available exploit code exists, and the flaw has been present since illumos-gate commit a73be61a in 2021.
Host denial-of-service in illumos bhyve allows a privileged guest user to panic the host by executing a REP-prefixed MOVS or STOS instruction targeting kernel-emulated MMIO regions such as the local APIC. The flaw has existed since 2020 and affects illumos-gate and OmniOS builds prior to commit 696ecf8d, stemming from a failure to clear the VIES_REPEAT flag that leads to a VERIFY assertion in vie_advance_pc(). Publicly available exploit code exists, but no active exploitation has been confirmed.
Kernel heap corruption in the illumos data-link pseudo-driver (dld) allows an unprivileged local user - including one confined to a non-global zone that owns a datalink - to panic the system or potentially escalate privileges. The flaw in drv_ioc_prop_common() exploits a classic double-copyin TOCTOU race on the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls: the kernel sizes its heap allocation from pr_valsize on the first copyin but re-reads the entire ioctl struct from the same user address a second time, allowing a concurrent thread to enlarge pr_valsize between the two reads and overflow the under-sized buffer. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the upstream fix is confirmed by an illumos-gate commit.
illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat on a long file name in /dev/net. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
illumos smbsrv NULL pointer dereference allows system crash. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The devzvol_readdir function in illumos does not check the return value of a strchr call, which allows remote attackers to cause a denial of service (NULL pointer dereference and panic) via. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.