CVE-2026-104113 in OmniOS
Summary
by MITRE • 10/09/2026
A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified involves a critical memory management error within the IP management daemon ipmgmtd found in OmniOS and SmartOS operating systems. This flaw manifests as a double free condition that can be triggered by local users lacking specific administrative privileges. The core of the issue resides in the function ipmgmt_handler located in the source file usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c, which handles requests sent via door interfaces for modifying network interface configurations. When a request is received to modify an interface configuration, such as resetting it using IPMGMT_CMD_RESETIF, the daemon attempts to authorize the action by checking if the caller holds the solaris.network.interface.config authorization. During this process, the code retrieves the user credentials and immediately frees them using ucred_free before completing the full authorization check logic.
The technical flaw arises from an inconsistent handling of resource cleanup on error paths. Specifically, after freeing the credential object early to support lx-branded zones a feature introduced in 2014 via commit 4c170900 the code proceeds to perform the authorization verification. If this verification fails because the user lacks the necessary privileges, the execution flow diverts to an error handling path where ucred_free is invoked again on the same credential pointer that was already deallocated in the previous step. This results in a double free vulnerability which corrupts memory management structures and leads to undefined behavior within the daemon process. Although this specific implementation detail is not present in upstream illumos-gate it remains active in OmniOS r151020 and later versions as well as SmartOS prior to the application of corrective patches.
The operational impact of this vulnerability allows an unprivileged local user to cause a denial of service against the network configuration subsystem. By repeatedly sending crafted requests that trigger the authorization failure path, an attacker can force ipmgmtd to abort due to memory corruption errors. This crash causes the associated system service svc:/network/ip-interface-management to enter maintenance mode effectively halting all IP interface configuration operations on the affected host. While this does not directly grant code execution or privilege escalation it significantly disrupts network availability and management capabilities requiring manual intervention by a privileged administrator to restart the service and restore normal networking functionality.
From a classification perspective this vulnerability aligns with CWE-415 Double Free which describes errors where memory is freed more than once potentially leading to heap corruption and arbitrary code execution in less constrained environments though here it primarily results in process termination. In terms of attack tactics this behavior corresponds to ATT&CK technique T1073 Denial of Service via resource exhaustion or application crash leveraging local access to disrupt service availability. The root cause stems from premature resource deallocation without ensuring that subsequent error handling paths do not attempt redundant cleanup operations a common pitfall in systems programming where early returns and complex control flow intersect with manual memory management.
Mitigation strategies primarily involve applying the vendor-provided patches that correct the logic within ipmgmt_handler to ensure credentials are only freed once either by moving the free operation after all authorization checks or by setting pointers to null after freeing them to prevent subsequent accidental access. Until patches are applied administrators should restrict local user access to systems running vulnerable versions of OmniOS and SmartOS particularly those with lx-branded zone support enabled where this code path is active. Monitoring system logs for repeated crashes in the ipmgmtd process can serve as an indicator of potential exploitation attempts allowing security teams to respond promptly before sustained denial of service impacts production environments.