CVE-2026-104115 in illumos
Summary
by MITRE • 10/09/2026
A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte stack buffer without checking their length. The reparsed door at /var/run/reparsed_door is readable by all users and the door server does not check the caller's credentials, so an unprivileged local user can send an nfs-basic request with an overlong host or path component to overflow the buffer. On systems built with stack protection, which is the default, this causes reparsed to abort; repeated requests place the svc:/system/filesystem/reparse service into maintenance. The service is disabled by default. The flaw has existed since 2009 (illumos-gate commit 2f172c55), and affects any illumos distribution prior to illumos-gate commit 6a2df4aa.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability described constitutes a stack-based buffer overflow within the reparse point daemon, known as reparsed, which is part of the NFS basic reparse plugin in illumos operating systems. This flaw resides specifically in the get_fs_locations function located in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c. The core technical issue arises from an improper boundary check when handling input data. Specifically, the function copies host and path components of a reparse string into a fixed-size stack buffer that is only 1024 bytes long without verifying whether the incoming strings exceed this limit. This lack of validation allows for arbitrary write operations beyond the allocated memory space on the call stack, which can corrupt adjacent data structures or overwrite return addresses depending on the compiler and system configuration.
The operational impact of this vulnerability is significant due to the accessibility of the affected service interface. The reparsed door endpoint located at /var/run/reparsed_door possesses permissions that allow read access for all users on the system. Furthermore, the door server implementation fails to validate the credentials or privileges of the caller making requests through this interface. Consequently, an unprivileged local user can exploit this misconfiguration by sending crafted NFS basic reparse requests containing overlong host or path components. This action triggers the buffer overflow condition within the reparsed process, leading to immediate service disruption. On systems compiled with stack protection mechanisms enabled, which is the default configuration in modern builds of illumos, the exploitation results in the daemon aborting execution rather than allowing arbitrary code execution. Repeated attempts to exploit this flaw can cause the svc:/system/filesystem/reparse service to enter a maintenance state, effectively denying availability for any legitimate users relying on reparse point functionality within the NFS environment.
From a classification perspective, this vulnerability aligns with CWE-120, which describes buffer copy without checking size limits, and more specifically CWE-121, indicating a stack-based buffer overflow condition. The attack vector is classified under Local Privilege Escalation or Denial of Service depending on the ultimate goal, though in this specific instance where stack protection prevents code execution, it primarily manifests as a local denial-of-service vulnerability. In terms of MITRE ATT&CK framework mapping, this behavior corresponds to T1498 Network Endpoint Monitoring, specifically the aspect of resource exhaustion leading to service disruption, although the primary mechanism is memory corruption rather than simple volume-based flooding. The exploitation does not require network access but relies on local user interaction with a world-readable door interface, highlighting a failure in principle of least privilege regarding inter-process communication endpoints.
The vulnerability has been present since 2009, originating from illumos-gate commit 2f172c55, and affects all distributions prior to the fix introduced in commit 6a2df4aa. Despite its age, it remains relevant for legacy systems or those that have not applied subsequent patches. Mitigation strategies should prioritize updating the system to a version containing the corrective patch if available. For environments where immediate patching is not feasible, administrators can mitigate the risk by disabling the svc:/system/filesystem/reparse service, as noted in the advisory, since this service is disabled by default on most installations. Additionally, restricting access permissions to /var/run/reparsed_door so that only privileged users or specific groups can interact with it would prevent unprivileged local users from triggering the overflow condition until a permanent code fix is applied. Regular auditing of door server configurations and ensuring strict credential validation in IPC mechanisms are essential practices to prevent similar vulnerabilities in other system components.