PT-2023-31158 · Unknown+3 · Gnu Core Utilities+3

Moviuro · Published 2023-11-24 · Updated 2025-04-05 · CVE-2023-49298

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenZFS versions 2.1.13 and earlier OpenZFS versions 2.2.x through 2.2.1

Description The issue is related to the replacement of file contents with zero-valued bytes, potentially disabling security mechanisms in certain scenarios involving applications that rely on efficient copying of file data. This can occur when using applications like cp from recent GNU Core Utilities (coreutils) versions to preserve rule sets for denying unauthorized access, such as when configuring access control with the /etc/hosts.deny file. The issue is not always security-related but can be in realistic situations.

Recommendations For OpenZFS versions 2.1.13 and earlier, consider updating to a version where this issue is fixed, if available. For OpenZFS versions 2.2.x through 2.2.1, consider updating to a version where this issue is fixed, if available. As a temporary workaround, consider avoiding the use of applications that rely on efficient copying of file data, such as cp, when preserving security-related configurations until a patch is available. Restrict access to sensitive files and configurations to minimize the risk of exploitation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-49298

DLA-3766-1

DLA-4114-1

Affected Products

Debian

Gnu Core Utilities

Openzfs

Red Os

References · 32

• 🔥 https://github.com/openzfs/zfs/pull/15571 · Exploit
• 🔥 https://github.com/openzfs/zfs/issues/15526 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49298 · Security Note
• https://osv.dev/vulnerability/DLA-3766-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-49298 · Security Note
• https://news.ycombinator.com/item?id=38405731 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-49298 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4114-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49298 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49298 · Vendor Advisory
• https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308 · Patch
• https://ubuntu.com/security/CVE-2023-49298 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49298 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2023-49298 · Vendor Advisory
• https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14 · Note