Solaris Kernel Module Insertion Local Vulnerability
25 Mar. 2004
Summary
A vulnerability in Solaris exists which permits a local non-privileged user to insert a user supplied kernel module. Once a kernel module is successfully integrated into the kernel, it effectively gives the malicious user root permissions on the system.
Vulnerable Systems:
* Solaris versions 2.6 through 10
The loading of a user-supplied module by a non-privileged user is possible due to a directory traversal bug in the vfs_getvfssw() function within the kernel. There are two system calls which can be used in order to trigger this vulnerability, namely mount() and sysfs().
