CVE-2026-104116 in illumos
Summary
by MITRE • 10/09/2026
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the ZSD_CMD_NEW_ZONE command, which is intended to be sent by zoneadmd, without checking the caller's credentials. Because the zonestatd door is accessible to all users in every zone, an unprivileged user can send this command with an arbitrary zone ID, causing zonestatd to re-create its door file in that zone, so that new zonestat requests in that zone can fail while the file is replaced. The time taken to handle the command also reveals whether a given zone ID belongs to a running zone. The flaw has existed since 2010 (illumos-gate commit efd4c9b6), and affects any illumos distribution prior to illumos-gate commit 865b58d2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in the illumos operating system represents a critical failure in access control mechanisms within the zones statistics daemon, known as zonestatd. This flaw stems from a missing authorization check in the door server procedure, specifically the zsd_server function located in usr/src/cmd/zonestat/zonestatd/zonestatd.c. The architecture of illumos relies on zoneadmd to manage zone-specific operations and communicate with various daemons via doors, which are inter-process communication mechanisms. However, the implementation for handling the ZSD_CMD_NEW_ZONE command fails to validate whether the caller possesses the necessary privileges or belongs to a trusted process like zoneadmd. Consequently, any local user within any non-global zone can interact directly with this door server without authentication, bypassing intended security boundaries that should restrict such administrative actions to privileged entities only.
The operational impact of this vulnerability is twofold, involving both denial of service and information disclosure capabilities for an attacker operating at a low privilege level. By sending the ZSD_CMD_NEW_ZONE command with an arbitrary zone identifier, an unprivileged user can force zonestatd to re-create its door file within that target zone. This action temporarily disrupts the availability of statistics collection services in the targeted zone because new requests will fail while the file is being replaced or during the transition period. This constitutes a localized denial of service condition where legitimate monitoring and management tools may experience intermittent failures, potentially obscuring system health metrics or causing instability in automated systems that rely on consistent data streams from zonestatd.
Beyond the disruption of services, this flaw provides an avenue for information disclosure regarding the state of other zones within the same illumos instance. The time taken by the server to process the command varies depending on whether the specified zone ID corresponds to a currently running and active zone versus one that is inactive or non-existent. An attacker can exploit this timing difference through a side-channel attack, systematically probing different zone identifiers to determine which ones are actively running. This capability allows an adversary to map out the virtualization environment, identifying potential targets for further exploitation or simply gaining intelligence about the infrastructure's configuration and activity levels without needing elevated privileges.
This security deficiency has been present in the illumos codebase since 2010, originating from commit efd4c9b6 in the illumos-gate repository. It affects all distributions based on illumos prior to the fix introduced in commit 865b58d2. The longevity of this flaw highlights a gap in security testing and review processes for inter-process communication mechanisms within complex operating system architectures like zones. Such oversights can persist for years if automated tools do not specifically test for privilege escalation or unauthorized access via IPC channels, emphasizing the need for rigorous static analysis and penetration testing focused on door-based interactions in Unix-like systems.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as it involves an actor obtaining privileges that they should not have to perform administrative actions. It also relates to CWE-358, the Exposure of Information Through Side Channels, due to the timing-based detection of running zones. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1074, specifically data staged or collected for later exfiltration or reconnaissance purposes by mapping out available resources within a compromised environment. The lack of credential verification on IPC calls allows lateral movement and enumeration that would otherwise be restricted by the principle of least privilege inherent in zone isolation models.
Mitigation strategies primarily involve applying the patch associated with illumos-gate commit 865b58d2, which introduces proper authentication checks before processing commands intended for privileged daemons. Administrators running affected versions must ensure their systems are updated to a version that includes this fix. In environments where immediate patching is not feasible, network segmentation and strict firewall rules may help limit exposure if the door interfaces were exposed over networks, although typically these doors are local IPC mechanisms. Additionally, implementing monitoring solutions that detect unusual patterns of inter-process communication or frequent access attempts to zonestatd could provide early warning indicators of exploitation attempts. Regular audits of privilege assignments for system daemons and verification of authorization checks in all IPC endpoints are essential practices to prevent similar vulnerabilities from persisting in future releases.