illumos Reparse Plugin libnfs_basic.c get_fs_locations stack-based overflow

Summaryinfo

A vulnerability, which was classified as problematic, was found in illumos. The impacted element is the function get_fs_locations of the file usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c of the component Reparse Plugin. Such manipulation leads to stack-based overflow. This vulnerability is listed as CVE-2026-104115. The attack must be carried out locally. There is no available exploit. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in illumos (affected version not known). Affected by this issue is the function get_fs_locations of the file usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c of the component Reparse Plugin. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. CVE summarizes:

A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte stack buffer without checking their length. The reparsed door at /var/run/reparsed_door is readable by all users and the door server does not check the caller's credentials, so an unprivileged local user can send an nfs-basic request with an overlong host or path component to overflow the buffer. On systems built with stack protection, which is the default, this causes reparsed to abort; repeated requests place the svc:/system/filesystem/reparse service into maintenance. The service is disabled by default. The flaw has existed since 2009 (illumos-gate commit 2f172c55), and affects any illumos distribution prior to illumos-gate commit 6a2df4aa.

The advisory is shared for download at illumos.topicbox.com. This vulnerability is handled as CVE-2026-104115 since 10/01/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

It is declared as proof-of-concept.

Applying the patch 6a2df4aa5381599179ab6afb3165db81960dee35 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• illumos

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion