Missing Authorization Check in illumos Zones Statistics Daemon Affects Local Users

CVE-2026-104116

What is CVE-2026-104116?

A flaw exists in the illumos zones statistics daemon preventing proper authorization checks, enabling local users to disrupt the zonestat service across different zones. The vulnerability arises from the door server procedure zsd_server() failing to authenticate the requester, allowing any user to send the ZSD_CMD_NEW_ZONE command unverified. This mishandling can prompt zonestatd to unintentionally recreate its door file, causing service interruptions as new requests are issued while the file is being replaced. Moreover, the response duration can indicate whether specific zone IDs correspond to active zones, presenting a potential risk for information leakage. This issue has persisted since 2010 and affects all illumos distributions preceding the pertinent commit.

References