This notice is to advise Triton Cloud (public cloud) users, Triton On-Premises Software operators, and Open Source Triton users of a vulnerability reported by Zero Day Initiative (ZDI).
The following security vulnerability has been identified by Ben Murphy with Zero Day Initiative: ZDI-CAN-5106. Through ZDI, we have previously been made aware of this vulnerability. Here is a brief description of the issue and its resolution:
- Issue: A malicious DTrace helper can lead to zone escape via out-of-bounds relocation.
- Resolution: This issue was resolved by improved validation of user-supplied offsets.
Please proceed based on the following advice:
- This vulnerability has already been fixed throughout the Triton Cloud (public cloud). No further action is required of public cloud users.
- On-premises Triton (SDC7) software customers can mitigate this issue by following the instructions referenced in the Actions You Need to Take section below.
- Open Source Triton users can also mitigate this issue by following the instructions referenced in the Actions You Need to Take section below.
- An announcement regarding this vulnerability will be published at Zero Day's "Upcoming Advisories".
Actions Taken by Joyent
As noted above, the fix for this vulnerability has been applied to the Triton Cloud (public cloud). No further actions are required of public cloud users.
Actions You Need to Take
Triton On-Premises Software Users:
You are advised to apply this fix by updating your current Platform Image (PI) to the next available release (release-20171207-20171212T175708Z), using the following command on the support channel:
sdcadm platform install --latest
Open Source Triton Users:
- Upgrade servers to Platform Image (PI) release-20171207-20171212T175708Z or later
- Direct any further questions to: The SmartOS Community Mailing Lists and IRC
If you are a Joyent customer and have any further questions or concerns after reading the information provided above, please contact Joyent Support.
If you are an Open Source Triton user, please direct any further questions to the SmartOS Community Mailing Lists and IRC (as noted above).