File Data Manipulation Vulnerability in OpenZFS by OpenZFS

CVE-2023-49298

What is CVE-2023-49298?

OpenZFS versions through 2.1.13 and from 2.2.0 to 2.2.1 are susceptible to a vulnerability where under specific conditions, file contents may be replaced with zero-valued bytes. This could undermine various security mechanisms, particularly when applications utilize functionality like efficient file copying, such as the GNU Core Utilities' cp command. While this issue does not always have security implications, in practical scenarios—like managing access control through configuration files—it can lead to significant risks. Users of older versions, such as those before 2.1.4, may find this issue less prevalent due to default configurations that minimize its occurrence.

References