CVE-2023-49298 Other in n/a
OpenZFS may zero out file contents during copy operations, potentially disabling security mechanisms like access control lists.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49298?
CVE-2023-49298 is a high-severity vulnerability in n/a, published on 24 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.
Weakness: CWE-639
Which versions are affected by CVE-2023-49298?
It affects 1 product.
Products include Openzfs Openzfs.
How do I fix CVE-2023-49298?
Upgrade to a fixed version.
Is CVE-2023-49298 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-49298 exists.
Other vulnerabilities in n/a
Sources
Also known as ALPINE-CVE-2023-49298, DEBIAN-CVE-2023-49298, GHSA-mvg7-8xh2-47rf, UBUNTU-CVE-2023-49298.