CVE-2023-49298
📋 TL;DR
OpenZFS vulnerability where file contents can be replaced with zero-valued bytes during certain copy operations, potentially disabling security mechanisms like access control rules. Affects OpenZFS versions through 2.1.13 and 2.2.x through 2.2.1. This can impact systems using tools like GNU cp to manage security configuration files.
💻 Affected Systems
- OpenZFS
📦 What is this software?
Openzfs by Openzfs
Openzfs by Openzfs
⚠️ Risk & Real-World Impact
Worst Case
Security configuration files (like /etc/hosts.deny) are corrupted with zeros, disabling access controls and allowing unauthorized network access or privilege escalation.
Likely Case
Security configuration files become corrupted during administrative copy operations, temporarily disabling security mechanisms until manually corrected.
If Mitigated
Minimal impact if proper change control procedures and file integrity monitoring are in place to detect and correct corrupted files.
🎯 Exploit Status
Exploitation requires specific conditions: vulnerable OpenZFS version, applications using certain copy operations, and targeting of security configuration files. Not a direct remote code execution vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenZFS 2.1.14 and later
Vendor Advisory: https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14
Restart Required: Yes
Instructions:
1. Backup all ZFS datasets. 2. Update OpenZFS to version 2.1.14 or later. 3. Reboot the system to load the patched kernel module. 4. Verify the fix by checking the OpenZFS version.
🔧 Temporary Workarounds
Avoid using GNU cp with security-sensitive files
linuxUse alternative copy methods like rsync or cat for security configuration files
# Use rsync instead of cp for security files
rsync -a /path/to/source /path/to/destination
# Or use cat
cat /path/to/source > /path/to/destination
Implement file integrity monitoring
linuxMonitor critical security files for unexpected changes using tools like AIDE or Tripwire
# Install and configure AIDE
apt-get install aide
aideinit
aide --check
🧯 If You Can't Patch
- Implement strict change control procedures for security configuration files
- Regularly audit and verify integrity of security configuration files
🔍 How to Verify
Check if Vulnerable:
Check OpenZFS version with: modinfo zfs | grep versionCheck Version:
modinfo zfs | grep versionVerify Fix Applied:
Verify OpenZFS version is 2.1.14 or higher: modinfo zfs | grep version📡 Detection & Monitoring
Log Indicators:
- Sudden changes in file sizes for security configuration files
- Access control failures in application logs
- File integrity monitoring alerts
Network Indicators:
- Unexpected network connections that should be blocked
- Failed authentication attempts from previously blocked IPs
SIEM Query:
source="*syslog*" AND ("hosts.deny" OR "access control" OR "file corruption") AND ("zero" OR "corrupt" OR "failed")🔗 References
- https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308
- https://bugs.gentoo.org/917224
- https://github.com/openzfs/zfs/issues/15526
- https://github.com/openzfs/zfs/pull/15571
- https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14
- https://github.com/openzfs/zfs/releases/tag/zfs-2.2.2
- https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html
- https://news.ycombinator.com/item?id=38405731
- https://news.ycombinator.com/item?id=38770168
- https://web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files
- https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs/
- https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308
- https://bugs.gentoo.org/917224
- https://github.com/openzfs/zfs/issues/15526
- https://github.com/openzfs/zfs/pull/15571
- https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14
- https://github.com/openzfs/zfs/releases/tag/zfs-2.2.2
- https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html
- https://lists.debian.org/debian-lts-announce/2025/04/msg00009.html
- https://news.ycombinator.com/item?id=38405731
- https://news.ycombinator.com/item?id=38770168
- https://web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files
- https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs/
