illumos nscd Door Server nscd_frontend.c switcher denial of service

Summaryinfo

A vulnerability marked as problematic has been reported in illumos nscd. Affected is the function switcher of the file usr/src/cmd/nscd/nscd_frontend.c of the component Door Server. This manipulation causes denial of service. The identification of this vulnerability is CVE-2026-104112. The attack can only be executed locally. There is no exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability classified as problematic was found in illumos nscd (the affected version is unknown). Affected by this vulnerability is the function switcher of the file usr/src/cmd/nscd/nscd_frontend.c of the component Door Server. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are passed with a door call but not used by the request, and the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. Because nscd also runs with an unlimited file descriptor limit, an unprivileged local user, including one in a non-global zone, can repeatedly pass a descriptor to its zone's nscd in a door_call() loop, causing the file descriptor table of nscd to grow without bound in kernel memory. This causes a denial of service of nscd and can render processes in all zones on the host unresponsive. The flaw has existed since 2006 (illumos-gate commit cb5caa98), and affects any illumos distribution prior to illumos-gate commit af810a72.

The advisory is shared at illumos.topicbox.com. This vulnerability is known as CVE-2026-104112 since 10/01/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

It is declared as proof-of-concept.

Applying the patch af810a72c09944e884ec695e8dbf1702a4f424ae is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• illumos

Name

• nscd

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion