CVE-2023-49298
First published: Fri Nov 24 2023(Updated: )
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| OpenZFS OpenZFS | <=2.1.13 | |
| OpenZFS OpenZFS | =2.2.0 | |
| FreeBSD FreeBSD | =14.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308
- https://bugs.gentoo.org/917224
- https://github.com/openzfs/zfs/issues/15526
- https://github.com/openzfs/zfs/pull/15571
- https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14
- https://github.com/openzfs/zfs/releases/tag/zfs-2.2.2
- https://news.ycombinator.com/item?id=38405731
- https://news.ycombinator.com/item?id=38770168
- https://web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files
- https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs/
- https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-49298.
What is the severity level of CVE-2023-49298?
The severity level of CVE-2023-49298 is high with a score of 7.5.
Which versions of OpenZFS are affected by CVE-2023-49298?
OpenZFS versions 2.1.13 and 2.2.0 through 2.2.1 are affected by CVE-2023-49298.
What is the impact of CVE-2023-49298?
CVE-2023-49298 can potentially disable the security mechanisms by replacing file contents with zero-valued bytes.
Are there any references or resources available for CVE-2023-49298?
Yes, you can find more information about CVE-2023-49298 in the following references: 1. [GitHub - openzfs/zfs/pull/15571](https://github.com/openzfs/zfs/pull/15571) 2. [GitHub - openzfs/zfs/issues/15526](https://github.com/openzfs/zfs/issues/15526) 3. [Bugzilla - bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308](https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308)
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/weakness
- agent/author
- agent/severity
- agent/event
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/openzfs
- vendor/freebsd