07 october, 2009
| Document Audience: | PUBLIC | |
| Document ID: | 263388 | |
| Title: | Security Vulnerabilities in Solaris IP(7P) Module and STREAMS Framework May Lead to a Denial of Service (DoS) Condition | |
| Copyright Notice: | Copyright © 2009 Sun Microsystems, Inc. All Rights Reserved | |
| Update Date: | Wed Sep 30 00:00:00 MDT 2009 | |
Solution Type Sun Alert
Solution 263388 : Security Vulnerabilities in Solaris IP(7P) Module and STREAMS Framework May Lead to a Denial of Service (DoS) Condition
Bug ID
6646890, 6646366
ProductSolaris 8 Operating System Solaris 9 Operating System Solaris 10 Operating System OpenSolaris
Date of Workaround Release30-Sep-2009
SA Document BodySecurity Vulnerabilities in Solaris IP(7P) Module and STREAMS Framework May Lead to a Denial of Service (DoS) Condition
1. ImpactSecurity vulnerabilities in the Solaris IP(7P) module and STREAMS Framework may allow an unprivileged local user to leak kernel memory, eventually causing the system to hang. This is a type of Denial of Service (DoS).
2. Contributing Factors
These issues can occur in the following releases:
SPARC Platform
- Solaris 8
- Solaris 9 without patch 122300-44
- Solaris 10 without patch 141414-09
- OpenSolaris based upon builds snv_01 though snv_108
- Solaris 8
- Solaris 9 without patch 122301-44
- Solaris 10 without patch 141415-09
- OpenSolaris based upon builds snv_01 though snv_108
OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. To determine the base build of OpenSolaris, the following command can be used:
$ uname -v
snv_108
1. If the described issue occurs, the following messages may be displayed on the system console or in the '/var/adm/messages' file:
sshd: [ID <id#> auth.error] error: fork: Error 0
WARNING: /etc/svc/volatile: File system full, swap space limit exceeded
WARNING: Sorry, no swap space to grow stack for pid <pid#>
inetd: [ID <id#> daemon.error] Unable to fork inetd_start method of instance
svc:/network/vnetd/tcp:default: Not enough space
Cannot map /lib/ld.so.1
kmem_cache_alloc+0x18c
allocb+0x94
allocb_cred+8
strmakedata+0xa0
strput+0x23c
strwrite_common+0x284
fop_write+0x20
write+0x268
kmem_cache_alloc+0x88
dblk_constructor+0x54
kmem_cache_alloc_debug+0x388
kmem_cache_alloc+0x88
allocb+0x4c
allocb_tryhard+0x1c
putnextctl1+0x30
ldterm_dosig+0x16c
ldtermrput+0x508
putnext+0x3f4
qdrain_syncq+0x368
drain_syncq+0x618
taskq_d_thread+0xbc
# echo ::findleaks -dv | /usr/bin/mdb -k unix.# vmcore.# > findleak.txt
(Where # is the current core dump number). Open findleak.txt to confirm the above stack trace.4. Workaround
There is no workaround for these issues. Please see the "Resolution" section below.
5. Resolution
These issues are addressed in the following releases:
SPARC Platform
- Solaris 9 with patch 122300-44 or later
- Solaris 10 with patch 141414-09 or later
- OpenSolaris based upon builds snv_109 or later
- Solaris 9 with patch 122301-44 or later
- Solaris 10 with patch 141415-09 or later
- OpenSolaris based upon builds snv_109 or later
Note: The READMEs of Solaris 8 patches developed on or after 1 April 2009 are available to all customers. However, Solaris 8 entered EOSL Phase 2 on April 1, 2009 and thus entitlement for these patches, including those that fix security vulnerabilities, requires the purchase of the Solaris 8 Vintage Patch Service. More information about the Solaris 8 Vintage Patch Service is available at:
For more information on Security Sun Alerts, see Technical Instruction ID 213557.
This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.