Openzfs
Monthly
Privilege escalation in OpenZFS on Linux allows any unprivileged local user to perform root-restricted ZFS pool operations - including pool creation, import, destruction, event log access, and fault injection via zinject - by exploiting a flaw in ioctl authorization that incorrectly treats CAP_SYS_ADMIN held within a user-created unprivileged namespace as equivalent to real host-level root privilege. The vulnerability requires only that the user can open /dev/zfs and that the kernel permits unprivileged user namespace creation, a configuration that is enabled by default on most modern Linux distributions. No public exploit has been identified at time of analysis, and the OpenZFS project has released patched versions 2.2.11, 2.3.9, and 2.4.4 addressing all affected branches.
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Privilege escalation in OpenZFS on Linux allows any unprivileged local user to perform root-restricted ZFS pool operations - including pool creation, import, destruction, event log access, and fault injection via zinject - by exploiting a flaw in ioctl authorization that incorrectly treats CAP_SYS_ADMIN held within a user-created unprivileged namespace as equivalent to real host-level root privilege. The vulnerability requires only that the user can open /dev/zfs and that the kernel permits unprivileged user namespace creation, a configuration that is enabled by default on most modern Linux distributions. No public exploit has been identified at time of analysis, and the OpenZFS project has released patched versions 2.2.11, 2.3.9, and 2.4.4 addressing all affected branches.
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.