Solaris 10 Kernel Patches May Cause a System Panic, Data Corruption, and/or a Denial of Service Security Issue |
|
| Category : | AvailabilityData LossSecurity |
| Release Phase : | Resolved |
| Product : | Solaris 10 Operating System
|
| Bug Id : | 6397308
|
| Date of Resolved Release : | 18-JUL-2006
|
Impact
Solaris 10 kernel patches 118822-29 or later for SPARC and 118844-29 or later for x86, may cause a system panic, kernel memory corruption, application failure, and/or data corruption.
This issue may allow an unprivileged local user the ability to panic the system or kill an application, creating a Denial of Service (DoS) condition. In addition, if the system is configured for anonymous ftp, this issue may allow an unprivileged remote user to panic the system.
Contributing Factors
This issue can occur in the following releases:
SPARC Platform
- Solaris 10 with patch 118822-29 or later and without patch 118833-11
x86 Platform
- Solaris 10 with patch 118844-29 or later and without patch 118855-08
Notes:
- Solaris 8 and Solaris 9 are not impacted by this issue.
- The Java Virtual Machine (JVM) in JRE1.4.x is one known application that may cause this issue to occur.
Symptoms
Due to the nature of this issue, the symptoms are varied. Kernel data structure corruption may lead to a variety of panics due to various traps and/or consistency checks. In general, the symptoms will be variable and difficult to diagnose. Very minor changes in environment may cause the issue to come or go in a seemingly random fashion.
Workaround
Many patches require the KU patches that cause this issue. As such, removing these patches is not advisable as a workaround to this issue. To remove these patches would be difficult and would remove many other good updates from the system.
Resolution
This issue is addressed in the following releases:
SPARC Platform
- Solaris 10 with patch 118833-11 or later
x86 Platform
- Solaris 10 with patch 118855-08 or later
AttachmentsThis solution has no attachment