Category
Security
Release Phase
Resolved
ProductSolaris 10 Operating System
Bug Id
6479756
Date of Resolved Release30-JUL-2007
Impact
A security vulnerability in the DTrace (see dtrace(1M)) dynamic tracing framework may allow a local user who has privileges to run certain DTrace programs to cause the system to panic or become unresponsive. This is a type of Denial of Service (DoS). The minimum privilege required is the PRIV_DTRACE_USER privilege (see privileges(5)).
Contributing Factors
This issue can occur in the following releases:
SPARC platform
- Solaris 10 without patch 125100-10
x86 Platform
- Solaris 10 without patch 125101-10
Note: This issue does not affect Solaris 8 or Solaris 9.
Symptoms
If this issue is encountered on a SPARC system, especially those based on the UltraSPARC T1 processor, the system will typically panic with an error message of "send mondo timeout".
It is unlikely for this issue to occur on x86 based systems but if it does occur the system will appear to be either hung or extremely slow.
Workaround
If users have been granted any of the DTrace privileges then those privileges can be removed until the patches have been applied. The additional privileges may have been configured via policy.conf(4) or user_attr(4). If the privileges have been configured directly in the local "/etc/user_attr" file, then they can be removed using the usermod(1M) utility as shown:
# usermod -K limitpriv=all,!dtrace_user,!dtrace_proc,!dtrace_kernel user
Note: Privileges may also be assigned via an execution profile (see exec_attr(4)) or even to running processes using ppriv(1).
Resolution
This issue is addressed in the following releases:
SPARC platform
- Solaris 10 with patch 125100-10 or later
x86 platform
- Solaris 10 with patch 125101-10 or later
References
125101-10
125100-10
AttachmentsThis solution has no attachment