Executive brief
A vulnerability in the Oracle Solaris operating system's virtualization components could allow a highly privileged user to compromise the system. An attacker with existing administrative access could exploit this flaw to modify or delete critical system data and cause the entire server to crash or hang. This impact can lead to significant service outages and loss of data integrity for organizations relying on Solaris 11.3 for their infrastructure.
Technical details
This vulnerability exists in the Kernel Zones virtualized block driver subcomponent of Oracle Solaris 11.3. It is classified as difficult to exploit, requiring the attacker to have high privileges and local logon access to the infrastructure. Successful exploitation allows an attacker to perform unauthorized creation, deletion, or modification of critical data accessible to Solaris. Additionally, the flaw can be used to trigger a hang or a frequently repeatable crash, resulting in a complete denial of service (DoS). The vulnerability is tracked as CVE-2017-3276 and was addressed in the Oracle Critical Patch Update for January 2017.
Affected products
- Oracle Solaris 11.3
Timeline
- 2017-01-27: disclosed
- 2017-01-27: advisory: Oracle Critical Patch Update January 2017