A security vulnerability in the Solaris Volume Manager (SVM) ioctl(2) interface may allow a local unprivileged user the ability to cause a system panic, which is a type of Denial of Service (DoS).

This issue can occur in the following releases:

SPARC Platform

• Solaris 9 with patch 113026-03 or later or patch 113073-11 or later, and without patch 116669-31
• Solaris 10 without patch 124256-03

x86 Platform

• Solaris 9 with patch 113994-02 or later or patch 118559-12 or later, and without patch 122371-07
• Solaris 10 without patch 126257-04

NOTE: Solaris 8 Volume Management services are provided by Solstice Disksuite 4.2.1 rather than SVM and thus Solaris 8 is not affected by this issue.

Should the described issue occur, the system will panic with a stack trace similar to the following:

    ....
    md_base_ioctl()
    md_admin_ioctl()
    mdioctl()
    cdev_ioctl()
    spec_ioctl()
    ioctl+0x1a7()
    _sys_call+0xe5()

There is no workaround for this issue. Please see the Resolution section below.

This issue is addressed in the following releases:

SPARC Platform

• Solaris 9 with patch 116669-31 or later
• Solaris 10 with patch 124256-03 or later

x86 Platform

• Solaris 9 with patch 122371-07 or later
• Solaris 10 with patch 126257-04 or later

This solution has no attachment