7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
7.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
38.4%
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios
involving applications that try to rely on efficient copying of file data,
can replace file contents with zero-valued bytes and thus potentially
disable security mechanisms. NOTE: this issue is not always security
related, but can be security related in realistic situations. A possible
example is cp, from a recent GNU Core Utilities (coreutils) version, when
attempting to preserve a rule set for denying unauthorized access. (One
might use cp when configuring access control, such as with the
/etc/hosts.deny file specified in the IBM Support reference.) NOTE: this
issue occurs less often in version 2.2.1, and in versions before 2.1.4,
because of the default configuration in those versions.
Author | Note |
---|---|
mdeslaur | This was fixed by a SRU in bug 2044657. For jammy and mantic, the packages were subsequently released in the -security pocket, but for focal, it is still in -updates, but the issue isn’t seen in the focal version because of the default configuration so marking as released. No USN has been published for these updates. |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | zfs-linux | < any | UNKNOWN |
ubuntu | 20.04 | noarch | zfs-linux | < 0.8.3-1ubuntu12.17 | UNKNOWN |
ubuntu | 22.04 | noarch | zfs-linux | < 2.1.5-1ubuntu6~22.04.4 | UNKNOWN |
ubuntu | 23.10 | noarch | zfs-linux | < 2.2.0-0ubuntu1~23.10.3 | UNKNOWN |
ubuntu | 24.04 | noarch | zfs-linux | < 2.2.2-0ubuntu2 | UNKNOWN |
ubuntu | 16.04 | noarch | zfs-linux | < any | UNKNOWN |
gist.github.com/rincebrain/e23b4a39aba3fadc04db18574d30dc73
github.com/openzfs/zfs/releases/tag/zfs-2.2.2
launchpad.net/bugs/cve/CVE-2023-49298
news.ycombinator.com/item?id=38405731
nvd.nist.gov/vuln/detail/CVE-2023-49298
security-tracker.debian.org/tracker/CVE-2023-49298
web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files
www.cve.org/CVERecord?id=CVE-2023-49298
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
7.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
38.4%