A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user running in any zone to issue the ZSD_CMD_NEW_ZONE command without credential verification. This can disrupt zonestat in other zones and, because the time taken to process the command reveals whether a zone ID is active, it also lets attackers enumerate which zones are currently running. The flaw is a classic missing authorization weakness.

The vulnerability affects all illumos distributions, including OmniOS and the illumos-gate source tree, that were built before commit 865b58d2. Any release prior to that commit is considered vulnerable and does not contain the required credential check in zonestatd.

The CVSS score of 1.9 indicates a low severity vulnerability. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. Because the attack vector is local to the zone, an attacker must have some form of user access within the system, but no privilege escalation is required. The impact, while limited to denial of service for zone statistics and limited information disclosure, can degrade operational monitoring and allow attackers to learn more about the zone topology.