Note: This is an archival copy of Security Sun Alert 228406 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1017347.1.
Solaris 10 Operating System
Date of Resolved Release
A security vulnerability in the DTrace (see dtrace(1M)) dynamic tracing framework may allow a local user who has privileges to run certain DTrace programs to cause the system to panic or become unresponsive. This is a type of Denial of Service (DoS). The minimum privilege required is the PRIV_DTRACE_USER privilege (see privileges(5)).
This issue can occur in the following releases:
Note: This issue does not affect Solaris 8 or Solaris 9.
If this issue is encountered on a SPARC system, especially those based on the UltraSPARC T1 processor, the system will typically panic with an error message of "send mondo timeout".
It is unlikely for this issue to occur on x86 based systems but if it does occur the system will appear to be either hung or extremely slow.
If users have been granted any of the DTrace privileges then those privileges can be removed until the patches have been applied. The additional privileges may have been configured via policy.conf(4) or user_attr(4). If the privileges have been configured directly in the local "/etc/user_attr" file, then they can be removed using the usermod(1M) utility as shown:
# usermod -K limitpriv=all,!dtrace_user,!dtrace_proc,!dtrace_kernel user
Note: Privileges may also be assigned via an execution profile (see exec_attr(4)) or even to running processes using ppriv(1).
This issue is addressed in the following releases:
This solution has no attachment