CVE-2026-104117: Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config authorization for the IPMGMTCMDIPMPUPDATE command, although its handler, ipmgmtipmpupdatehandler(), writes to the persistent ipadm configuration when the IPMGMTPERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
illumos-gateto a version that resolves this vulnerability.Patch e8d3efa1
Event History
Frequently Asked Questions
Who can exploit this issue?
An unprivileged local user can exploit it. Remote-only attackers are not described as able to trigger the vulnerable IPMP update operation.
What configuration changes can an attacker make?
The attacker can add interfaces to or remove interfaces from existing IPMP groups in the persistent ipadm configuration. The issue applies when the IPMGMT_PERSIST flag is used for the IPMP update command.
Does exploitation immediately alter live network configuration?
No. The running configuration is not changed; the malicious persistent configuration takes effect when stored settings are next applied, such as during boot.
How can affected systems be identified?
Systems based on illumos-gate before commit e8d3efa1 are affected. The flaw was introduced in 2021 by illumos-gate commit a73be61a.
What is the likely operational impact?
When the altered persistent configuration is later applied, it may disrupt network connectivity through unauthorized changes to IPMP group membership.