illumos Door Dispatch Table ipmgmt_door.c ipmgmt_ipmp_update_handler improper authorization

Summaryinfo

A vulnerability classified as problematic was found in illumos. This affects the function ipmgmt_ipmp_update_handler of the file usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c of the component Door Dispatch Table. Executing a manipulation can lead to improper authorization. This vulnerability is tracked as CVE-2026-104117. The attack is restricted to local execution. No exploit exists. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability has been found in illumos (version unknown) and classified as problematic. This vulnerability affects the function ipmgmt_ipmp_update_handler of the file usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c of the component Door Dispatch Table. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect integrity, and availability. CVE summarizes:

A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.

The advisory is shared for download at illumos.topicbox.com. This vulnerability was named CVE-2026-104117 since 10/01/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

It is declared as proof-of-concept.

Applying the patch e8d3efa1 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• illumos

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion