OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can re...
Original description
The description as published by the source.
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-49298 zfs Fixed in: 2.2.1-r1
- Debian DEBIAN-CVE-2023-49298 zfs-linux Fixed in: 2.0.3-9+deb11u2
- Ubuntu UBUNTU-CVE-2023-49298 zfs-linux
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report bugs.freebsd.org
- report github.com
- web bugs.gentoo.org
- web github.com
- web github.com
- web lists.debian.org
- web news.ycombinator.com
- web news.ycombinator.com
- web web.archive.org
- web theregister.com
- web lists.debian.org