Product
Solaris 10 Operating System

Bug Id
6479756

Date of Resolved Release
30-JUL-2007

Impact

A security vulnerability in the DTrace (see dtrace(1M)) dynamic tracing framework may allow a local user who has privileges to run certain DTrace programs to cause the system to panic or become unresponsive. This is a type of Denial of Service (DoS). The minimum privilege required is the PRIV_DTRACE_USER privilege (see privileges(5)).

Contributing Factors

This issue can occur in the following releases:

SPARC platform

• Solaris 10 without patch 125100-10

x86 Platform

• Solaris 10 without patch 125101-10

Note: This issue does not affect Solaris 8 or Solaris 9.

Symptoms

If this issue is encountered on a SPARC system, especially those based on the UltraSPARC T1 processor, the system will typically panic with an error message of "send mondo timeout".

It is unlikely for this issue to occur on x86 based systems but if it does occur the system will appear to be either hung or extremely slow.

Workaround

If users have been granted any of the DTrace privileges then those privileges can be removed until the patches have been applied. The additional privileges may have been configured via policy.conf(4) or user_attr(4). If the privileges have been configured directly in the local "/etc/user_attr" file, then they can be removed using the usermod(1M) utility as shown:

    # usermod -K limitpriv=all,!dtrace_user,!dtrace_proc,!dtrace_kernel user

Note: Privileges may also be assigned via an execution profile (see exec_attr(4)) or even to running processes using ppriv(1).

Resolution

This issue is addressed in the following releases:

SPARC platform

• Solaris 10 with patch 125100-10 or later

x86 platform

• Solaris 10 with patch 125101-10 or later

References

125101-10
125100-10




Attachments

This solution has no attachment