Category
Security
Release Phase
Resolved
Bug Id
6731600
ProductSolaris 10 Operating System
OpenSolaris
Date of Resolved Release23-Jun-2009
Security Vulnerability in the Solaris IP(7P) Multicast Reception May Lead to a Denial of Service (DoS) Condition
1. Impact
A security vulnerability in the Solaris IP(7P) multicast reception may
allow local unprivileged users to leak kernel memory, thereby causing a
Denial of Service (DoS) condition.
2. Contributing Factors
This issue can occur in the following releases:
SPARC Platform
- Solaris 10 with patch 137111-05 or later or with patch 137137-09 and without patch 141414-01
- OpenSolaris based upon builds snv_67 through snv_93
x86 Platform
- Solaris 10 with patch 137112-05 or later or with patch 137138-09 and without patch 141415-01
- OpenSolaris based upon builds snv_67 through snv_93
Note: Solaris 8 and 9 are not
impacted by this issue.
OpenSolaris distributions may include additional bug fixes above and
beyond the build from which it was derived. The base build can be
derived as follows:
$ uname -v
snv_101
3. Symptoms
1. If the described issue occurs, the following messages may be
displayed on the system console or in the '/var/adm/messages' file, as
in the following example:"
phyint_reach_random: SIOCSLIFLNKINFO (interface <ifname>):
Interrupted system call
rpcbind: [ID <id#> daemon.error] rpcbind terminating on signal.
in.ndpd: [ID <id#> daemon.error] terminated
sshd: [ID <id#> auth.error] error: fork: Error 0
WARNING: /etc/svc/volatile: File system full, swap space limit exceeded
WARNING: Sorry, no swap space to grow stack for pid <pid#>
inetd: [ID <id#> daemon.error] Unable to fork inetd_start method of instance
svc:/network/vnetd/tcp:default: Not enough space
Cannot map /lib/ld.so.1
2. A forced coredump generated from unresponsive systems which have the
'kmem_flags' variable set to 0xf in the '/etc/system' file (see
system(4) for modifying this file) may show the following memory leaks:
kmem_cache_alloc_debug()
kmem_cache_alloc()
allocb()
ill_arp_alloc()
ill_create_squery()
ip_ll_send_enabmulti_req()
kmem_cache_alloc_debug()
kmem_cache_alloc()
dblk_constructor()
kmem_cache_alloc_debug()
kmem_cache_alloc()
allocb()
ill_arp_alloc()
ill_create_squery()
ip_ll_send_enabmulti_req()
kmem_cache_alloc_debug()
genunix:kmem_cache_alloc()
genunix:allocb()
ip:ill_arp_alloc()
ip:ill_create_squery()
ip:ip_ll_send_disabmulti_req()
kmem_cache_alloc_debug()
kmem_cache_alloc()
dblk_constructor()
kmem_cache_alloc_debug()
kmem_cache_alloc()
allocb()
ill_arp_alloc()
ill_create_squery()
ip_ll_send_disabmulti_req()
The following command can be executed as "root" user to find memory
leaks in the coredump files:
# echo ::findleaks -dv | /usr/bin/mdb -k unix.# vmcore.# > findleak.txt
(Where # is the current core dump number). Open findleak.txt to confirm
the above stack trace.
3. Live debugging may be done on systems which have the 'kmem_flags'
variable set in the "/etc/system" file. This may be done by executing
the following command as "root" on the system console:
#/usr/bin/mdb -K (enter kmdb)
[0]>::findleaks -dv
Confirm from the findleaks output that the above mentioned stack trace is seen.
[0]>:c
#/usr/bin/mdb -U (exit kmdb)
The output of 'findleaks -dv' may show the memory leaks described above.
4. Workaround
There is no workaround for this issue. Please see the 'Resolution'
section below.
5. Resolution
This issue is addressed in the following releases:
SPARC Platform
- Solaris 10 with patch 141414-01 or later
- OpenSolaris based upon builds snv_94 or later
x86 Platform
- Solaris 10 with patch 141415-01 or later
- OpenSolaris based upon builds snv_94 or later
For more
information on
Security Sun Alerts, see 1009886.1.
This Sun Alert
notification is being provided to you on
an "AS IS"
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU
ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT
OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This
Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.
Copyright 2000-2009 Sun
Microsystems,
Inc., 4150 Network Circle, Santa
Clara, CA 95054 U.S.A. All rights reserved.References
141414-01
141415-01
AttachmentsThis solution has no attachment