CVE-2006-3824 EXPLOIT
4.9
MEDIUM · CVSS 2.0 · EPSS 1% (pctl 61)
Patch early
A public exploit exists.
Description
systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function. NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness error or integer underflow.
Scoring
| CVSS | 4.9 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:L/AC:L/Au:N/C:C/I:N/A:N |
| EPSS | 0.99% — more likely to be exploited than 61% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-07-25 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| sun | solaris |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure (2) | 2006-08-22 |
| exploit-db | Solaris 10 - 'sysinfo()' Local Kernel Memory Disclosure (1) | 2006-07-24 |
References
- http://secunia.com/advisories/21148
- http://securitytracker.com/id?1016555
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102343-1
- http://www.idefense.com/intelligence/vulnerabilities/display.php?id=410
- http://www.securityfocus.com/archive/1/440849/100/100/threaded
- http://www.securityfocus.com/archive/1/440986/100/100/threaded
- http://www.securityfocus.com/bid/19104
- http://www.vupen.com/english/advisories/2006/2936
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27901
- http://secunia.com/advisories/21148
- http://securitytracker.com/id?1016555
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102343-1
- http://www.idefense.com/intelligence/vulnerabilities/display.php?id=410
- http://www.securityfocus.com/archive/1/440849/100/100/threaded
- http://www.securityfocus.com/archive/1/440986/100/100/threaded
- http://www.securityfocus.com/bid/19104
- http://www.vupen.com/english/advisories/2006/2936
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27901
→ the Explorer · watch your stack · NVD