Security Vulnerability in Solaris SCTP (Stream Control Transmission Protocol (see sctp(7P)) and SDP (Sockets Direct Protocol driver (see sdp(7D)) sockets May Allow Unprivileged Users to Cause a Denial of Service (DoS) Condition

---

A security vulnerability in SCTP (Stream Control Transmission Protocol (see sctp(7P))) and SDP (Sockets Direct Protocol driver (see sdp(7D))) sockets:

1. Impact

A security vulnerability in SCTP (Stream Control Transmission Protocol (see sctp(7P))) and SDP (Sockets Direct Protocol driver (see sdp(7D))) sockets may allow local unprivileged users to leak kernel memory, thereby causing a Denial of Service (DoS) condition.

2. Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• OpenSolaris based upon builds snv_106 through snv_126
  

x86 Platform

• OpenSolaris based upon builds snv_106 through snv_126

Note 1: Solaris 8, 9 and 10 are not impacted by this issue.

Note 2: OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived.  To determine the base build of OpenSolaris, the following command can be used:

    $ uname -v
    snv_86

3. Symptoms

A saved crash dump of the kernel generated on unresponsive systems may show a large number of buffers being used by SCTP or SDP.  The following command can be run to find buffer usage information from the operating system crash dump files:

    $ echo ::kmastat -m | mdb # | egrep "sdp_conn_cache|sctp_conn_cache"

Where # is the numerical suffix of the two operating system crash dump files.  For example, if the suffix is "3", mdb infers  that  it should examine  the  files  "unix.3"  and "vmcore.3".

    sctp_conn_cache             2264      1      7         0M         1     0 
    sdp_conn_cache              5032   6379   6379        49M      6379     0

The value in the third column indicates the number of buffers in use. If the value is much larger than the expected number of active connections, then a Denial of Service may have occurred.

4. Workaround

There is no workaround for this issue.  Please see the Resolution section below.

5. Resolution

This issue is addressed in the following releases:

SPARC Platform

• OpenSolaris based upon builds snv_127 or later
  

x86 Platform

• OpenSolaris based upon builds snv_127 or later

For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.




Attachments

This solution has no attachment