CVE-2023-49298

NameCVE-2023-49298
DescriptionOpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1056752

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
zfs-linux (PTS)buster/contrib0.7.12-2+deb10u2vulnerable
bullseye/contrib2.0.3-9+deb11u1vulnerable
bookworm/contrib2.1.11-1vulnerable
trixie/contrib, sid/contrib2.2.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
zfs-linuxsource(unstable)2.1.14-11056752

Notes

[bookworm] - zfs-linux <no-dsa> (contrib not supported)
[bullseye] - zfs-linux <no-dsa> (contrib not supported)
https://github.com/openzfs/zfs/issues/15526
https://github.com/openzfs/zfs/pull/15571

Search for package or bug name: Reporting problems