Description
systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function. NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness error or integer underflow.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure (2) EDB-2241 · local · Aug 22, 2006 · verified
- Solaris 10 - 'sysinfo()' Local Kernel Memory Disclosure (1) EDB-2067 · local · Jul 24, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1016555 vdb-entry
- 20060721 Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability mailing-list
- ADV-2006-2936 vdb-entry
- 21148 third-party-advisory
- 20060720 Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability third-party-advisory
- 19104 vdb-entry
- 102343 vendor-advisory
- 20060724 Re: Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability mailing-list
- solaris-systeminfo-overflow(27901) vdb-entry