Security Vulnerabilities in Solaris IP(7P) Module and STREAMS Framework May Lead to a Denial of Service (DoS) Condition

---

Security Vulnerabilities in Solaris IP(7P) Module and STREAMS Framework May Lead to a Denial of Service (DoS) Condition

1. Impact

Security vulnerabilities in the Solaris IP(7P) module and STREAMS Framework may allow an unprivileged local user to leak kernel memory, eventually causing the system to hang. This is a type of Denial of Service (DoS).

2. Contributing Factors

These issues can occur in the following releases:

SPARC Platform

• Solaris 8 without patches 127721-03 and 116965-36
• Solaris 9 without patch 122300-44
• Solaris 10 without patch 141414-09
• OpenSolaris based upon builds snv_01 though snv_108

x86 Platform

• Solaris 8 without patches 127722-03 and 116966-35
• Solaris 9 without patch 122301-44
• Solaris 10 without patch 141415-09
• OpenSolaris based upon builds snv_01 though snv_108

Note: Solaris 8 entered EOSL Phase 2 on 1 April 2009. Entitlement to patches developed on or after 1 April 2009 requires the purchase of the Solaris 8 Vintage Patch Service. See Note in section 5 for more details.

OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. To determine the base build of OpenSolaris, the following command can be used:

$ uname -v
snv_108

3. Symptoms

1. If the described issue occurs, the following messages may be displayed on the system console or in the '/var/adm/messages' file:

sshd: [ID <id#> auth.error] error: fork: Error 0
WARNING: /etc/svc/volatile: File system full, swap space limit exceeded
WARNING: Sorry, no swap space to grow stack for pid <pid#>
inetd: [ID <id#> daemon.error] Unable to fork inetd_start method of instance
svc:/network/vnetd/tcp:default: Not enough space
Cannot map /lib/ld.so.1

2. A forced coredump generated from unresponsive systems which have the 'kmem_flags' variable set to 0xf in the '/etc/system' file (see system(4) for modifying this file) may show memory leaks in one of the streams_dblk_* memory caches, and also in the streams_mblk cache, with one of the following stacks:

kmem_cache_alloc+0x18c
allocb+0x94
allocb_cred+8
strmakedata+0xa0
strput+0x23c
strwrite_common+0x284
fop_write+0x20
write+0x268

kmem_cache_alloc+0x88
dblk_constructor+0x54
kmem_cache_alloc_debug+0x388
kmem_cache_alloc+0x88
allocb+0x4c
allocb_tryhard+0x1c
putnextctl1+0x30
ldterm_dosig+0x16c
ldtermrput+0x508
putnext+0x3f4
qdrain_syncq+0x368
drain_syncq+0x618
taskq_d_thread+0xbc

The following command can be run as "root" user to find memory leaks in the coredump files:

# echo ::findleaks -dv | /usr/bin/mdb -k unix.# vmcore.# > findleak.txt

(Where # is the current core dump number). Open findleak.txt to confirm the above stack trace.

4. Workaround

There is no workaround for these issues. Please see the "Resolution" section below.

5. Resolution

These issues are addressed in the following releases:

SPARC Platform

• Solaris 8 with patches 127721-03 or later and 116965-36 or later
  
• Solaris 9 with patch 122300-44 or later
• Solaris 10 with patch 141414-09 or later
• OpenSolaris based upon builds snv_109 or later

x86 Platform

• Solaris 8 with patches 127722-03 or later and 116966-35 or later
  
• Solaris 9 with patch 122301-44 or later
• Solaris 10 with patch 141415-09 or later
• OpenSolaris based upon builds snv_109 or later

Note: The READMEs of Solaris 8 patches developed on or after 1 April 2009 are available to all customers. However, Solaris 8 entered EOSL Phase 2 on April 1, 2009 and thus entitlement for these patches, including those that fix security vulnerabilities, requires the purchase of the Solaris 8 Vintage Patch Service. More information about the Solaris 8 Vintage Patch Service is available at:


For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.

Modification History

11-Nov-2009: Updated Contributing Factors and Resolution sections, now Resolved

Attachments

This solution has no attachment