CVE-2026-104114 in illumos-gate
Summary
by MITRE • 10/09/2026
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in this advisory constitutes a critical NULL pointer dereference within the Network Auto-Magic daemon, known as nwamd, which is part of the illumos operating system ecosystem. This flaw resides specifically in the door_if.c source file, affecting the nwamd_door_switch function. The core technical deficiency lies in the execution order of validation checks; the code attempts to write data into a caller's request structure before verifying that valid argument data was actually supplied by the invoking process. Furthermore, this operation occurs prior to any authentication or credential verification steps. This inversion of security logic means that the system assumes the presence and validity of input data without confirming its existence, leading directly to memory corruption when no arguments are provided during a door call invocation.
From an operational perspective, the impact of this vulnerability is significant for systems where automatic network configuration via nwamd is enabled. Because the associated door endpoint located at /etc/svc/volatile/nwam/nwam_door possesses permissions that allow access by all local users, any unprivileged account on the system can exploit this flaw. By issuing a door_call() command with empty or null argument data, an attacker can trigger the NULL pointer dereference, causing immediate termination of the nwamd process. The consequences extend beyond simple service interruption; repeated exploitation attempts force the Service Management Facility to place the svc:/network/physical:nwam service into maintenance mode. This state effectively disables automatic network configuration capabilities for the host, potentially leading to a denial of service condition where new or changing network interfaces cannot be configured automatically until manual intervention occurs.
The severity and context of this vulnerability align with several established industry standards. The primary flaw is classified under CWE-476, which denotes NULL Pointer Dereference, as the code accesses memory at an address that has not been allocated or validated. Additionally, because the exploitation requires local access to execute a specific system call against a service accessible by unprivileged users, it falls under ATT&CK technique T1053, specifically related to Scheduled/Job Task execution if leveraged for persistence, though primarily here it represents Local Privilege Escalation prerequisites or Denial of Service via resource exhaustion. The vulnerability highlights a failure in input validation and access control sequencing, which are fundamental principles outlined in CWE-20 regarding improper input handling.
Mitigation strategies must address both the immediate technical flaw and broader security posture. For administrators running illumos distributions affected by this issue prior to commit 0f1064d9, applying the specific patch associated with that gate update is the primary remediation step. This update corrects the logic flow within nwamd_door_switch to ensure credential checks and argument validation occur before any memory writes take place. In environments where automatic network configuration via nwamd is not strictly required, disabling the svc:/network/physical:nwam service provides an effective workaround by removing the attack surface entirely. Regular auditing of local user permissions on system doors and enforcing principle of least privilege for inter-process communication endpoints can further reduce risk exposure in illumos-based systems.