CVE-2006-3824
Sun Solaris - Kernel Memory Exposure via sysinfo System Call
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-3824. PoCs published by Marco Ivaldi, prdelka.
AI-analyzed exploit summary This exploit leverages a signedness error in the Solaris sysinfo(2) system call to trigger a kernel memory leak by passing a 0 variable count argument, causing a -1 argument to be used by the copyout function. It dumps kernel memory to a specified file.
Description
systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function. NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness error or integer underflow.
Exploits (2)
This exploit leverages a signedness error in the Solaris sysinfo(2) system call to trigger a kernel memory leak by passing a 0 variable count argument, causing a -1 argument to be used by the copyout function. It dumps kernel memory to a specified file.
This exploit leverages an integer overflow in Solaris' sysinfo() system call to disclose kernel memory. It allocates a large buffer and writes kernel memory contents to a file specified by the user.