Illumos is an open-source operating system kernel descended from OpenSolaris, deployed in specialized server and storage environments where system stability is critical. Vulnerabilities affecting the kernel skew toward serious outcomes and frequently acquire public exploit code, concentrated in the core illumos-gate codebase and recurrent across memory-safety and synchronization issues such as buffer overflows, improper input validation, and locking defects inherent to large native kernel codebases. Defenders maintaining illumos deployments should prioritize kernel updates; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Illumos over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-0217HIGH The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos befor | Jun 12, 2012 | 7.2 | 65 | NO | YES |
CVE-2020-27678CRITICAL An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_u | Oct 26, 2020 | 9.8 | 30 | NO | NO |
CVE-2016-6560HIGH illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash. | Mar 31, 2017 | 8.6 | 27 | NO | NO |
CVE-2016-6561HIGH illumos smbsrv NULL pointer dereference allows system crash. | Mar 31, 2017 | 7.5 | 26 | NO | NO |
CVE-2019-9579HIGH An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have unintended access, e.g., an attacker with W | Dec 26, 2022 | 8.1 | 23 | NO | NO |
CVE-2023-31284HIGH illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat on a long file name in /dev/net. | May 4, 2023 | 7.8 | 20 | NO | NO |
CVE-2021-43395MEDIUM An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 2021.04, and SmartOS 20210923. A local unp | Dec 26, 2022 | 5.5 | 20 | NO | NO |
CVE-2014-9491MEDIUM The devzvol_readdir function in illumos does not check the return value of a strchr call, which allows remote attackers to cause a denial of service (NULL pointer dereference and p | Jan 20, 2015 | 5.0 | 16 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Illumos.
Media articles that mention a CVE ID that affects a product developed by Illumos — matched by CVE ID, not by vendor name.