TPS-2018-003 ZDI-CAN-5106

Overview

This notice is to advise Triton Cloud (public cloud) users, Triton On-Premises Software operators, and Open Source Triton users of a vulnerability reported by Zero Day Initiative (ZDI).

Description

The following security vulnerability has been identified by Ben Murphy with Zero Day Initiative: ZDI-CAN-5106. Through ZDI, we have previously been made aware of this vulnerability. Here is a brief description of the issue and its resolution:

  • Issue: A malicious DTrace helper can lead to zone escape via out-of-bounds relocation.
  • Resolution: This issue was resolved by improved validation of user-supplied offsets.

Please proceed based on the following advice:

  • This vulnerability has already been fixed throughout the Triton Cloud (public cloud). No further action is required of public cloud users.
  • On-premises Triton (SDC7) software customers can mitigate this issue by following the instructions referenced in the Actions You Need to Take section below.
  • Open Source Triton users can also mitigate this issue by following the instructions referenced in the Actions You Need to Take section below.
  • An announcement regarding this vulnerability will be published at Zero Day’s “Upcoming Advisories”.

Actions Taken by Joyent

As noted above, the fix for this vulnerability has been applied to the Triton Cloud (public cloud). No further actions are required of public cloud users.

Actions You Need to Take

Triton On-Premises Software Users

You are advised to apply this fix by updating your current Platform Image (PI) to the next available release (release-20171207-20171212T175708Z), using the following command on the support channel:

sdcadm platform install --latest

Open Source Triton Users

Support

If you are a Joyent customer and have any further questions or concerns after reading the information provided above, please contact Joyent Support.

As noted above, if you are an Open Source Triton user, please direct any further questions to the SmartOS Community Mailing Lists and IRC.