Security Vulnerability in the Solaris IP(7P) Multicast Reception May Lead to a Denial of Service (DoS) Condition

---

Security Vulnerability in the Solaris IP(7P) Multicast Reception May Lead to a Denial of Service (DoS) Condition

1. Impact

A security vulnerability in the Solaris IP(7P) multicast reception may allow local unprivileged users to leak kernel memory, thereby causing a Denial of Service (DoS) condition.

2. Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• Solaris 10 with patch 137111-05 or later or with patch 137137-09 and without patch 141414-01
• OpenSolaris based upon builds snv_67 through snv_93

x86 Platform

• Solaris 10 with patch 137112-05 or later or with patch 137138-09 and without patch 141415-01
• OpenSolaris based upon builds snv_67 through snv_93

Note: Solaris 8 and 9 are not impacted by this issue.

OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. The base build can be derived as follows:

$ uname -v
snv_101

3. Symptoms

1. If the described issue occurs, the following messages may be displayed on the system console or in the '/var/adm/messages' file, as in the following example:"

phyint_reach_random: SIOCSLIFLNKINFO (interface <ifname>): 
Interrupted system call
rpcbind: [ID <id#>  daemon.error] rpcbind terminating on signal.
in.ndpd: [ID <id#>  daemon.error] terminated
sshd: [ID <id#> auth.error] error: fork: Error 0
WARNING: /etc/svc/volatile: File system full, swap space limit exceeded
WARNING: Sorry, no swap space to grow stack for pid <pid#>
inetd: [ID <id#> daemon.error] Unable to fork inetd_start method of instance 
svc:/network/vnetd/tcp:default: Not enough space
Cannot map /lib/ld.so.1

2. A forced coredump generated from unresponsive systems which have the 'kmem_flags' variable set to 0xf in the '/etc/system' file (see system(4) for modifying this file) may show the following memory leaks:

kmem_cache_alloc_debug()
kmem_cache_alloc()
allocb()
ill_arp_alloc()
ill_create_squery()
ip_ll_send_enabmulti_req()

kmem_cache_alloc_debug()
kmem_cache_alloc()
dblk_constructor()
kmem_cache_alloc_debug()
kmem_cache_alloc()
allocb()
ill_arp_alloc()
ill_create_squery()
ip_ll_send_enabmulti_req()

kmem_cache_alloc_debug()
genunix:kmem_cache_alloc()
genunix:allocb()
ip:ill_arp_alloc()
ip:ill_create_squery()
ip:ip_ll_send_disabmulti_req()

kmem_cache_alloc_debug()
kmem_cache_alloc()
dblk_constructor()
kmem_cache_alloc_debug()
kmem_cache_alloc()
allocb()
ill_arp_alloc()
ill_create_squery()
ip_ll_send_disabmulti_req()

The following command can be executed as "root" user to find memory leaks in the coredump files:

# echo ::findleaks -dv | /usr/bin/mdb -k unix.# vmcore.# > findleak.txt

(Where # is the current core dump number). Open findleak.txt to confirm the above stack trace.

3. Live debugging may be done on systems which have the 'kmem_flags' variable set in the "/etc/system" file. This may be done by executing the following command as "root" on the system console:

#/usr/bin/mdb -K (enter kmdb)
[0]>::findleaks -dv
Confirm from the findleaks output that the above mentioned stack trace is seen.
[0]>:c
#/usr/bin/mdb -U (exit kmdb)

The output of 'findleaks -dv' may show the memory leaks described above.

4. Workaround

There is no workaround for this issue. Please see the 'Resolution' section below.

5. Resolution

This issue is addressed in the following releases:

SPARC Platform

• Solaris 10 with patch 141414-01 or later
• OpenSolaris based upon builds snv_94 or later

x86 Platform

• Solaris 10 with patch 141415-01 or later
• OpenSolaris based upon builds snv_94 or later

For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.



Attachments

This solution has no attachment