OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can re...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2023-49298 zfs Corrigé dans: 2.2.1-r1
- Debian DEBIAN-CVE-2023-49298 zfs-linux Corrigé dans: 2.0.3-9+deb11u2
- Ubuntu UBUNTU-CVE-2023-49298 zfs-linux
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report bugs.freebsd.org
- report github.com
- web bugs.gentoo.org
- web github.com
- web github.com
- web lists.debian.org
- web news.ycombinator.com
- web news.ycombinator.com
- web web.archive.org
- web theregister.com
- web lists.debian.org