TI-2009-02720 Aliases CVE-2009-2857 GHSA-4r97-p529-3c59

The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly…

LOW 24CWE-667Published 2009-08-19 · Updated 2025-01-21

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-667 and the CVSS impact.

Summary

The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtual-memory implementations, which allows local users to cause a denial of service (deadlock and system halt) via vectors involving mmap and write operations on the same file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00265 18th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:oracle:opensolaris::::::::	before snv_103	Vulnerable	Oracle
cpe:2.3:o:oracle:solaris:8:::::::*	8	Vulnerable	Oracle
cpe:2.3:o:oracle:solaris:9:::::::*	9	Vulnerable	Oracle
cpe:2.3:o:oracle:solaris:10:::::::*	10	Vulnerable	Oracle

cpe:2.3:o:oracle:opensolaris:*:*:*:*:*:*:*:* Versions before snv_103 Vulnerable ·Oracle
cpe:2.3:o:oracle:solaris:8:*:*:*:*:*:*:* Versions 8 Vulnerable ·Oracle
cpe:2.3:o:oracle:solaris:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·Oracle
cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2009-2857
2026-10-03 Alias added: GHSA-4r97-p529-3c59

References

Patch 2

Advisory 1

ADV-2009-2291

Other 1

oval:org.mitre.oval:def:6152

TI-2010-03407 Unspecified vulnerability in Oracle OpenSolaris allows remote attackers to affect… CVSS 2.0HIGH 9.0
TI-2010-00082 Unspecified vulnerability in Oracle OpenSolaris 8, 9, and 10 allows remote attackers to… CVSS 2.0HIGH 7.6
TI-2010-03406 Unspecified vulnerability in Oracle OpenSolaris allows remote attackers to affect… CVSS 2.0MEDIUM 6.4
TI-2010-00843 Unspecified vulnerability in the Solaris component in Oracle Sun Product Suite 10 and… CVSS 2.0HIGH 7.2
TI-2010-03333 Unspecified vulnerability in Oracle Solaris 10 and OpenSolaris allows local users to… CVSS 2.0MEDIUM 6.3
TI-2010-00877 Unspecified vulnerability in Oracle OpenSolaris 10 allows local users to affect… CVSS 2.0MEDIUM 6.2

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences