CVE-2026-104116: Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the ZSDCMDNEWZONE command, which is intended to be sent by zoneadmd, without checking the caller's credentials. Because the zonestatd door is accessible to all users in every zone, an unprivileged user can send this command with an arbitrary zone ID, causing zonestatd to re-create its door file in that zone, so that new zonestat requests in that zone can fail while the file is replaced. The time taken to handle the command also reveals whether a given zone ID belongs to a running zone. The flaw has existed since 2010 (illumos-gate commit efd4c9b6), and affects any illumos distribution prior to illumos-gate commit 865b58d2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
illumos-gateto a version that resolves this vulnerability.Patch 865b58d2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unprivileged local user in any zone can exploit it, because the zonestatd door is accessible to all users in every zone. Remote access is not described in the available information.
What does an attacker need to do to trigger the disruption or enumerate zones?
The attacker can send the ZSD_CMD_NEW_ZONE command directly to the zonestatd door with an arbitrary zone ID. Processing the command can re-create the target zone's door file, causing new zonestat requests there to fail during replacement, while processing time can indicate whether the zone ID is running.
Are default or broadly deployed configurations affected?
The issue affects illumos distributions prior to illumos-gate commit 865b58d2. The vulnerable door is described as accessible to all users in every zone, so environments running an affected version with zonestatd available expose this interface to local users.
How can I determine whether a system is affected?
Check whether the system's illumos source or distribution includes illumos-gate commit 865b58d2. Versions prior to that commit are affected; the flaw has existed since the 2010 illumos-gate commit efd4c9b6.