Multiple CVEs for illumos and distros: door server processes

The illumos name service cache daemon (nscd) does not release file descriptors that a door client passes but the request does not use. switcher() in usr/src/cmd/nscd/nscd_frontend.c leaves those descriptors open, and the main door at /var/run/name_service_door accepts them from any user in the zone. An unprivileged local user, including one in a non-global zone, can loop door_call() and pass descriptors so nscd's unlimited file-descriptor table grows without bound in kernel memory. That denies service to nscd and can make processes in every zone on the host unresponsive. The bug has existed since 2006 and affects every illumos distribution before illumos-gate commit af810a72; no public proof-of-concept is known and it is not in the CISA KEV catalog.

Do: Install an illumos build that includes illumos-gate commit af810a72 (or a distribution package that backports it) and restart nscd. Until then, restrict local and non-global-zone logins that can call the name-service door, and watch nscd's open file-descriptor count and kernel memory; restarting nscd frees leaked descriptors but does not fix the leak.

A double-free (CWE-415) in the IP management daemon ipmgmtd on OmniOS and SmartOS lets an unprivileged local user crash the daemon. When a door request that changes interface configuration is processed, ipmgmt_handler() frees the caller's credential with ucred_free() immediately after reading the user ID, then frees it again on the error path if the caller lacks solaris.network.interface.config (for example an IPMGMT_CMD_RESETIF request). The abort can be repeated until svc:/network/ip-interface-management goes to maintenance, blocking IP interface configuration; there is no confidentiality or integrity impact (CVSS 4.0 5.4). The early free was added in 2014 for lx-branded zones (OmniOS commit 4c170900) and is absent from upstream illumos-gate, so OmniOS r151020 and later and SmartOS builds before the fix are affected. No public proof of concept is listed and the issue is not in CISA KEV, although the CVSS vector marks exploit maturity as E:P.

Do: Install the OmniOS and SmartOS updates that remove the extra ucred_free() in ipmgmtd; the advisory does not name a fixed build, so confirm the fix is in the release you deploy. Upstream illumos-gate is not affected. Until patched, limit unprivileged local accounts and alert if svc:/network/ip-interface-management enters maintenance.

A missing authorization check in the illumos IP management daemon (ipmgmtd) lets an unprivileged local user change the persistent IP multipathing (IPMP) configuration. The door dispatch path for IPMGMT_CMD_IPMP_UPDATE does not require the solaris.network.interface.config authorization, so ipmgmt_ipmp_update_handler() can write the stored ipadm configuration when the IPMGMT_PERSIST flag is set and add interfaces to, or remove them from, existing IPMP groups. The running configuration is not changed immediately; the altered stored config is applied later, such as at boot, and can disrupt network connectivity. The bug has been present since illumos-gate commit a73be61a in 2021 and affects any illumos distribution built before commit e8d3efa1. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Update any illumos-based system to a build that includes illumos-gate commit e8d3efa1 or later, using the fixed packages from your distribution (OpenIndiana, OmniOS, SmartOS, and others track illumos-gate separately; no single version number is given). Until then, limit local unprivileged accounts and review stored ipadm/IPMP configuration for unexpected interface membership before the next reboot or config apply.