{"id":35092,"date":"2026-10-10T00:32:29","date_gmt":"2026-10-09T16:32:29","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-104113"},"modified":"2026-10-10T00:32:29","modified_gmt":"2026-10-09T16:32:29","slug":"cve-2026-104113","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-104113","title":{"rendered":"CVE-2026-104113 &#8211; A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local u"},"content":{"rendered":"<p>A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr\/src\/cmd\/cmd-inet\/lib\/ipmgmtd\/ipmgmt_door.c frees the caller&#8217;s credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:\/network\/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-35092","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/35092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=35092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=35092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=35092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}