Description
The ucode_ioctl function in intel/io/ucode_drv.c in Sun Solaris 10 and OpenSolaris snv_69 through snv_133, when running on x86 architectures, allows local users to cause a denial of service (panic) via a request with a 0 size value to the UCODE_GET_VERSION IOCTL, which triggers a NULL pointer dereference in the ucode_get_rev function, related to retrieval of the microcode revision.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Solaris/Open Solaris UCODE_GET_VERSION IOCTL - Denial of Service EDB-11351 · dos · Feb 7, 2010
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- TA10-103B third-party-advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-143913-01-1
- solaris-microcode-dos(55991) vdb-entry
- 38452 third-party-advisory
- 1021799 vendor-advisory
- oval:org.mitre.oval:def:6959 vdb-entry signature
- http://www.oracle.com/technetwork/topics/security/cpuapr2010-099504.html
- 20100131 [TKADV2010-001] Oracle Solaris UCODE_GET_VERSION IOCTL Kernel NULL Pointer Dereference mailing-list
- 38016 vdb-entry
- 275910 vendor-advisory
- 62046 vdb-entry
- http://www.trapkit.de/advisories/TKADV2010-001.txt
- ADV-2010-0270 vdb-entry