OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can re...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2023-49298 zfs 修正版: 2.2.1-r1
- Debian DEBIAN-CVE-2023-49298 zfs-linux 修正版: 2.0.3-9+deb11u2
- Ubuntu UBUNTU-CVE-2023-49298 zfs-linux
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report bugs.freebsd.org
- report github.com
- web bugs.gentoo.org
- web github.com
- web github.com
- web lists.debian.org
- web news.ycombinator.com
- web news.ycombinator.com
- web web.archive.org
- web theregister.com
- web lists.debian.org