Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
11 vulnerabilities by openzfs
GCVE-1988-2026-0098
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:49
VLAI
EPSS
VEX
Title
OpenZFS Linux open zpool manipulation and escapes via unprivileged userns
Summary
I am hopeful that upstream patches and remediation guidance will be
available soon. I have been sitting on these for a bit, and have run this
through AI services hosted in Singapore and the United States, and had
notified CERT on 8/12/2026. In order to minimize the risk of asymmetric
knowledge of these threats being used against defenders, I am opting for
full-disclosure.
Cheers from HOPE
--Bird
## Report metadata
- **Product:** OpenZFS on Linux (`spl.ko` and `zfs.ko`; out-of-tree and not
part of the Linux kernel source tree)
- **OpenZFS revision audited:** `9b7642df931a765509403318553f2910daf71305`
(development version `2.4.99-1`, commit title "Harden recv record
validation")
- **Linux validation kernel:** `7.2.0-rc3-00275-gaf5e34a41cd6`
- **Validation environments:** disposable QEMU guest with generic KASAN and
`CONFIG_KASAN_VMALLOC=y`; a stock IncusOS appliance guest for
deployment-level authorization/volume-swap validation; disposable QEMU
appliance VMs for Proxmox VE, TrueNAS SCALE, and Unraid dynamic
reachability
testing. Release-mode OpenZFS modules unless stated otherwise.
- **Research dates:** 2026-07-17 through 2026-07-25
- **Report updated:** 2026-07-25
- **Reporter:** Erica Windisch
- **Tracker umbrella:** [issue #26](
https://github.com/ewindisch/linux-research-tracker/issues/26)
All kernel execution used disposable QEMU/cloud-hypervisor guests — the
KASAN
research guest or the stock IncusOS appliance guest. Host-side work was
limited
to building, offline image construction, and driving those guests.
### Revision notes
- **2026-07-25 (validation-chain results):** OZ-3c and OZ-6 move from
**LIKELY** to **VALIDATED** with dynamic triggers in the KASAN guest
(OZ-3c: UBSAN array-index-out-of-bounds at `zfs_replay.c:115`; OZ-6: KASAN
null-ptr-deref in `vdev_is_concrete` and slab-out-of-bounds in
`spa_ld_log_sm_cb`). QNAP QZFS static analysis validates
Z1/Z2/dnode-bonus S3
and gang overrun, and BLOCKS log-spacemap S4 (feature absent). The
upstream
patch audit confirms every OZ finding remains **UNFIXED** at upstream
master
HEAD `3020c18c` (2026-07-24); only OZ-7 has an open, contested PR
(#18620).
Full audit:
[`research/upstream-patch-audit.md`](../research/upstream-patch-audit.md).
- **2026-07-25 (OZ-4 on Proxmox VE):** the Proxmox VE 8.x OZ-4 cell is
upgraded
from provisional to a confirmed dynamic verdict. On `6.8.12-37-pve` /
OpenZFS `2.2.10-pve1`, importing the armed dnode-bonus pool (`dn_bonuslen=
0x400`, `zfs-77-d77-s3v2.img`) **from inside the delegated LXC container**
(CT100 with the OZ-1 verified `/dev/zfs` passthrough) fired the
`dbuf_read_bonus` overflow on `spa_tryimport → spa_load →
spa_ld_trusted_config` and crashed the kernel (NULL-deref in `strcmp`
during
`vdev_open_children_impl`; host-side corroboration showed SLUB
`LIST_POISON`
heap corruption in `dbuf_sync_list`). OZ-4 is therefore **VIABLE from the
delegated/privileged container** and **BLOCKED by default** (default
unprivileged LXC has no `/dev/zfs`). A container→root shell was not
reproduced on the stock appliance (release kernel faults
deterministically;
no KASLR leak). Full verdict and evidence:
`linux-research/.fleet-coord/oz4-proxmox-verdict.md`;
`linux-research/appliance-harness/proxmox-ve/runs/20260725T150254Z/evidence/`.
- **2026-07-25 (OZ-4 on Unraid):** the Unraid 7.3.0 OZ-4 cell is upgraded
from
provisional to a confirmed dynamic verdict. On `6.18.29-Unraid` / OpenZFS
`2.4.1-1`, importing the inflated-bonus pool (`dn_bonuslen=0x1000`,
`zfs-77-d77-s3v3.img`) from a `--privileged` Docker container fails
`insufficient replicas` while the structurally identical clean control
imports ONLINE; the kernel survives (silent heap corruption, no
panic/Oops).
OZ-4 is therefore **VIABLE from `--privileged`** and **BLOCKED** by
default
and `--device /dev/zfs` (no `/dev/zfs` / no `CAP_SYS_ADMIN`). A
container→root
shell was not pursued (requires heap grooming + KASLR bypass). Full
verdict
and evidence: `linux-research/.fleet-coord/oz4-unraid-verdict.md`;
`linux-research/appliance-harness/unraid/runs/20260725T150925Z/evidence/`.
- **2026-07-25 (OZ-4 OCI delivery on IncusOS):** an OCI image
(`oz4-delivery:latest`) carrying the armed pool (`d77.img`) was built with
podman, repacked as an Incus image, and launched as a default unprivileged
Incus container on IncusOS `202607192224` (OpenZFS `2.4.3-1`). The
container
received `/dev/zfs` and the ioctls were authorized (OZ-1 reachability
**VIABLE**), but the host kernel could not open the file vdev at the
container-relative path (`/opt/d77.img`), so the OZ-4 overflow never fired
(**BLOCKED** for the in-container E2E fire). IncusOS's shell-less design
removes the host-side bind-mount escape hatch that made the fire possible
on
Proxmox VE. Full verdict and evidence:
`linux-research/.fleet-coord/oz4-oci-incusos-verdict.md`;
`linux-research/incusos-spike/runs/20260725-oz4-oci/evidence/`.
- **2026-07-25 (OZ-4 OCI delivery on TrueNAS SCALE):** the same OCI image
(`oz4-delivery:latest`) was launched as a default unprivileged Incus
container on TrueNAS SCALE 25.04.2.4. The entrypoint auto-fired the import
ioctl, but the host kernel could not open the container-relative file vdev
(`/opt/d77.img`), so the OZ-4 overflow never fired (**BLOCKED**). This
refines the prior TrueNAS host-side **VIABLE** verdict: the overflow is
reachable from a host path, but not from a self-contained OCI image in a
default container. Full verdict and evidence:
`linux-research/.fleet-coord/oz4-oci-truenas-verdict.md`;
`linux-research/appliance-harness/truenas-scale/runs/20260725T190000Z/evidence/`.
- **2026-07-25 (OZ-4 on TrueNAS):** the Dynamically tested appliances table
gains an **OZ-4 column**. TrueNAS SCALE 25.04.2.4 (running OpenZFS
`2.3.0-1`) is **VIABLE** for OZ-4 from the default unprivileged container:
the armed dnode-bonus pool imported ONLINE with no error erevent
(oversized
`dn_bonuslen` accepted, not rejected) on the production non-KASAN kernel,
and the same image fired `Write of size 1024 in dbuf_read_impl` via
`spa_tryimport` under KASAN. The kernel survives the corruption; a
container→root shell is not demonstrated (neighbor-lottery + KASLR, as in
the 77b campaign). Proxmox VE and Unraid OZ-4 cells are marked
**BLOCKED** by
default pending their sibling fleet validation tasks. Full verdict and
evidence path: `linux-research/.fleet-coord/oz4-truenas-verdict.md`.
- **2026-07-25 (OZ-4 OCI delivery, round 2 — VALIDATED on TrueNAS SCALE and
Unraid):** the malicious-OCI-image vector is upgraded from **BLOCKED** to
**VALIDATED** on two appliances. The round-1 blocker was that the host
kernel's `vdev_file_open` resolves vdev paths in the host mount namespace,
so a container-internal `/opt/d77.img` is never opened. Round 2 defeats
this
with an **identical-path host bind mount** (the image entrypoint stages
its
embedded armed pool onto a bind-mounted host path visible at the same
absolute path in both namespaces, then imports from that path). On
**TrueNAS
SCALE 25.04.2.4** the vector fires from a **default unprivileged** Incus
container (no `security.privileged`, no explicit device add — only the
default `/dev/zfs`, an identical-path `disk` bind, and a `1777` host
staging
path): the armed import **panicked the production kernel** (GPF in
`__kmalloc` on the `spa_tryimport → spa_config_generate` path, crashing
task
`Comm: zpool` as the container's mapped uid in `ZFS_IOC_POOL_TRYIMPORT`),
while the structurally identical clean control imported ONLINE. On
**Unraid
7.3.0** the image-carried payload fires via `docker run --privileged` (the
required and sufficient capability); the negative control showed the bind
mount is not even required under Unraid's `vfs` storage driver. The Unraid
result is **expected behavior** — a `--privileged` container holds full
host
capabilities by design — and is retained for matrix completeness only; it
is
not scored as a finding. The TrueNAS round-2 fire is the significant
result,
but note its two deployment concessions: an identical-path host bind and a
world-writable host staging path must be granted to the container (as an
app
manifest's hostPath grant would provide). The Unraid kernel survives
(silent
corruption → `insufficient replicas`); the TrueNAS
crash is a **reliable image-delivered container→host-kernel DoS** — no
heap
grooming required. IncusOS remains **BLOCKED** for this vector (shell-less
appliance; no host bind-mount escape hatch). Full verdicts and evidence:
`linux-research/.fleet-coord/oz4-oci-truenas2-verdict.md`,
`linux-research/.fleet-coord/oz4-oci-unraid-verdict.md`;
`linux-research/appliance-harness/truenas-scale/runs/20260725T193000Z/evidence/`,
`linux-research/appliance-harness/unraid/runs/20260725T194343Z/evidence/`.
- **2026-07-26 (OZ-4 OCI on IncusOS, round 2 — VALIDATED with ZERO host-side
setup):** IncusOS flips from the fleet's only **BLOCKED** to
**VALIDATED**,
and the malicious-OCI-image vector now has a no-setup fire. The round-1
blocker (host kernel resolves vdev paths in the host mount namespace;
shell-less appliance precludes an admin bind mount) is defeated **without
any bind**: the container's own rootfs necessarily exists on the host at
the
predictable path
`/var/lib/incus/storage-pools/local/containers/<ct>/rootfs/`,
so the image's payload at `/opt/d77.img` is host-resolvable by
construction.
A malicious OCI image launched as a **default unprivileged** container
(default profile only — no `security.privileged`, no device add, no bind)
carries a static raw `ZFS_IOC_POOL_TRYIMPORT` PoC (hand-packed nvlist,
libzfs bypassed; `linux-research/incusos-spike/oz4-tryimport.c`,
zg-poolop.c
lineage) pointed at that host path; the ioctl is issued by **non-root uid
1000**, authorized via an image-controlled file capability
(`cap_sys_admin+ep` on the payload binary — an attacker image property,
not
an admin concession; verified differentially: cap cleared → `EPERM`). The
armed import **wedges the host kernel's ZFS load path and storage stack**
(`incusd` unresponsive, ioctl never returns; reproduced on a fresh
kernel),
while the structurally identical clean control imports in <1s. Negative
controls (wrong path, nonexistent path, cleared cap) all fail as expected.
On this kernel the overflow surfaces as a **wedge/storage-DoS** rather
than
TrueNAS's instant GPF-panic (heap-layout dependent); no root shell is
claimed. Attacker preconditions: get the victim to launch the image as a
default container; knowledge of the container name; nothing else. Full
verdict and evidence:
`linux-research/.fleet-coord/oz4-oci-incusos2-verdict.md`;
`linux-research/incusos-spike/runs/20260726-oz4-oci2/evidence/`.
- **2026-07-26 (OZ-4 OCI on TrueNAS SCALE, round 3 — VALIDATED with ZERO
host-side setup, kernel panic):** the zero-wire rootfs-path vector fires
on
TrueNAS SCALE 25.04.2.4 as well, upgrading round 2's concession-laden
fire.
A malicious OCI image launched as a **default unprivileged** Incus
container
(dir storage backend, default profile only — no privileged flag, no device
add, no bind, no host shell) carries the armed pool at `/opt/d77.img`, a
static raw-ioctl PoC (`oz4ti`, zg-poolop/xpl-107-poolop lineage), and a
**NATIVE-encoded** config nvlist naming the host-side rootfs path
(`/var/lib/incus/storage-pools/default/containers/<name>/rootfs/opt/d77.img`,
fully derivable from appliance defaults + the attacker-chosen container
name). The import is issued by a **non-root** nested-userns user (host
`UID: 2147001001`). The armed import **panicked the production kernel**
(GPF in `__kmalloc` on `spa_tryimport → spa_load →
spa_ld_load_special_directories`, corrupted SLUB freelist; crashing task
`Comm: oz4ti`), while the structurally identical clean control imported
`rc=
Severity
No CVSS data available.
Assigner
References
27 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Openzfs | Linux open |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Linux open",
"vendor": "Openzfs",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Erica Windisch"
}
],
"descriptions": [
{
"lang": "en",
"value": "I am hopeful that upstream patches and remediation guidance will be\navailable soon. I have been sitting on these for a bit, and have run this\nthrough AI services hosted in Singapore and the United States, and had\nnotified CERT on 8/12/2026. In order to minimize the risk of asymmetric\nknowledge of these threats being used against defenders, I am opting for\nfull-disclosure.\n\nCheers from HOPE\n\n--Bird\n\n## Report metadata\n\n- **Product:** OpenZFS on Linux (`spl.ko` and `zfs.ko`; out-of-tree and not\n part of the Linux kernel source tree)\n- **OpenZFS revision audited:** `9b7642df931a765509403318553f2910daf71305`\n (development version `2.4.99-1`, commit title \"Harden recv record\nvalidation\")\n- **Linux validation kernel:** `7.2.0-rc3-00275-gaf5e34a41cd6`\n- **Validation environments:** disposable QEMU guest with generic KASAN and\n `CONFIG_KASAN_VMALLOC=y`; a stock IncusOS appliance guest for\n deployment-level authorization/volume-swap validation; disposable QEMU\n appliance VMs for Proxmox VE, TrueNAS SCALE, and Unraid dynamic\nreachability\n testing. Release-mode OpenZFS modules unless stated otherwise.\n- **Research dates:** 2026-07-17 through 2026-07-25\n- **Report updated:** 2026-07-25\n- **Reporter:** Erica Windisch\n- **Tracker umbrella:** [issue #26](\nhttps://github.com/ewindisch/linux-research-tracker/issues/26)\n\nAll kernel execution used disposable QEMU/cloud-hypervisor guests \u2014 the\nKASAN\nresearch guest or the stock IncusOS appliance guest. Host-side work was\nlimited\nto building, offline image construction, and driving those guests.\n\n### Revision notes\n\n- **2026-07-25 (validation-chain results):** OZ-3c and OZ-6 move from\n **LIKELY** to **VALIDATED** with dynamic triggers in the KASAN guest\n (OZ-3c: UBSAN array-index-out-of-bounds at `zfs_replay.c:115`; OZ-6: KASAN\n null-ptr-deref in `vdev_is_concrete` and slab-out-of-bounds in\n `spa_ld_log_sm_cb`). QNAP QZFS static analysis validates\nZ1/Z2/dnode-bonus S3\n and gang overrun, and BLOCKS log-spacemap S4 (feature absent). The\nupstream\n patch audit confirms every OZ finding remains **UNFIXED** at upstream\nmaster\n HEAD `3020c18c` (2026-07-24); only OZ-7 has an open, contested PR\n(#18620).\n Full audit:\n[`research/upstream-patch-audit.md`](../research/upstream-patch-audit.md).\n- **2026-07-25 (OZ-4 on Proxmox VE):** the Proxmox VE 8.x OZ-4 cell is\nupgraded\n from provisional to a confirmed dynamic verdict. On `6.8.12-37-pve` /\n OpenZFS `2.2.10-pve1`, importing the armed dnode-bonus pool (`dn_bonuslen=\n 0x400`, `zfs-77-d77-s3v2.img`) **from inside the delegated LXC container**\n (CT100 with the OZ-1 verified `/dev/zfs` passthrough) fired the\n `dbuf_read_bonus` overflow on `spa_tryimport \u2192 spa_load \u2192\n spa_ld_trusted_config` and crashed the kernel (NULL-deref in `strcmp`\nduring\n `vdev_open_children_impl`; host-side corroboration showed SLUB\n`LIST_POISON`\n heap corruption in `dbuf_sync_list`). OZ-4 is therefore **VIABLE from the\n delegated/privileged container** and **BLOCKED by default** (default\n unprivileged LXC has no `/dev/zfs`). A container\u2192root shell was not\n reproduced on the stock appliance (release kernel faults\ndeterministically;\n no KASLR leak). Full verdict and evidence:\n `linux-research/.fleet-coord/oz4-proxmox-verdict.md`;\n\n`linux-research/appliance-harness/proxmox-ve/runs/20260725T150254Z/evidence/`.\n- **2026-07-25 (OZ-4 on Unraid):** the Unraid 7.3.0 OZ-4 cell is upgraded\nfrom\n provisional to a confirmed dynamic verdict. On `6.18.29-Unraid` / OpenZFS\n `2.4.1-1`, importing the inflated-bonus pool (`dn_bonuslen=0x1000`,\n `zfs-77-d77-s3v3.img`) from a `--privileged` Docker container fails\n `insufficient replicas` while the structurally identical clean control\n imports ONLINE; the kernel survives (silent heap corruption, no\npanic/Oops).\n OZ-4 is therefore **VIABLE from `--privileged`** and **BLOCKED** by\ndefault\n and `--device /dev/zfs` (no `/dev/zfs` / no `CAP_SYS_ADMIN`). A\ncontainer\u2192root\n shell was not pursued (requires heap grooming + KASLR bypass). Full\nverdict\n and evidence: `linux-research/.fleet-coord/oz4-unraid-verdict.md`;\n `linux-research/appliance-harness/unraid/runs/20260725T150925Z/evidence/`.\n- **2026-07-25 (OZ-4 OCI delivery on IncusOS):** an OCI image\n (`oz4-delivery:latest`) carrying the armed pool (`d77.img`) was built with\n podman, repacked as an Incus image, and launched as a default unprivileged\n Incus container on IncusOS `202607192224` (OpenZFS `2.4.3-1`). The\ncontainer\n received `/dev/zfs` and the ioctls were authorized (OZ-1 reachability\n **VIABLE**), but the host kernel could not open the file vdev at the\n container-relative path (`/opt/d77.img`), so the OZ-4 overflow never fired\n (**BLOCKED** for the in-container E2E fire). IncusOS\u0027s shell-less design\n removes the host-side bind-mount escape hatch that made the fire possible\non\n Proxmox VE. Full verdict and evidence:\n `linux-research/.fleet-coord/oz4-oci-incusos-verdict.md`;\n `linux-research/incusos-spike/runs/20260725-oz4-oci/evidence/`.\n- **2026-07-25 (OZ-4 OCI delivery on TrueNAS SCALE):** the same OCI image\n (`oz4-delivery:latest`) was launched as a default unprivileged Incus\n container on TrueNAS SCALE 25.04.2.4. The entrypoint auto-fired the import\n ioctl, but the host kernel could not open the container-relative file vdev\n (`/opt/d77.img`), so the OZ-4 overflow never fired (**BLOCKED**). This\n refines the prior TrueNAS host-side **VIABLE** verdict: the overflow is\n reachable from a host path, but not from a self-contained OCI image in a\n default container. Full verdict and evidence:\n `linux-research/.fleet-coord/oz4-oci-truenas-verdict.md`;\n\n`linux-research/appliance-harness/truenas-scale/runs/20260725T190000Z/evidence/`.\n- **2026-07-25 (OZ-4 on TrueNAS):** the Dynamically tested appliances table\n gains an **OZ-4 column**. TrueNAS SCALE 25.04.2.4 (running OpenZFS\n `2.3.0-1`) is **VIABLE** for OZ-4 from the default unprivileged container:\n the armed dnode-bonus pool imported ONLINE with no error erevent\n(oversized\n `dn_bonuslen` accepted, not rejected) on the production non-KASAN kernel,\n and the same image fired `Write of size 1024 in dbuf_read_impl` via\n `spa_tryimport` under KASAN. The kernel survives the corruption; a\n container\u2192root shell is not demonstrated (neighbor-lottery + KASLR, as in\n the 77b campaign). Proxmox VE and Unraid OZ-4 cells are marked\n**BLOCKED** by\n default pending their sibling fleet validation tasks. Full verdict and\n evidence path: `linux-research/.fleet-coord/oz4-truenas-verdict.md`.\n- **2026-07-25 (OZ-4 OCI delivery, round 2 \u2014 VALIDATED on TrueNAS SCALE and\n Unraid):** the malicious-OCI-image vector is upgraded from **BLOCKED** to\n **VALIDATED** on two appliances. The round-1 blocker was that the host\n kernel\u0027s `vdev_file_open` resolves vdev paths in the host mount namespace,\n so a container-internal `/opt/d77.img` is never opened. Round 2 defeats\nthis\n with an **identical-path host bind mount** (the image entrypoint stages\nits\n embedded armed pool onto a bind-mounted host path visible at the same\n absolute path in both namespaces, then imports from that path). On\n**TrueNAS\n SCALE 25.04.2.4** the vector fires from a **default unprivileged** Incus\n container (no `security.privileged`, no explicit device add \u2014 only the\n default `/dev/zfs`, an identical-path `disk` bind, and a `1777` host\nstaging\n path): the armed import **panicked the production kernel** (GPF in\n `__kmalloc` on the `spa_tryimport \u2192 spa_config_generate` path, crashing\ntask\n `Comm: zpool` as the container\u0027s mapped uid in `ZFS_IOC_POOL_TRYIMPORT`),\n while the structurally identical clean control imported ONLINE. On\n**Unraid\n 7.3.0** the image-carried payload fires via `docker run --privileged` (the\n required and sufficient capability); the negative control showed the bind\n mount is not even required under Unraid\u0027s `vfs` storage driver. The Unraid\n result is **expected behavior** \u2014 a `--privileged` container holds full\nhost\n capabilities by design \u2014 and is retained for matrix completeness only; it\nis\n not scored as a finding. The TrueNAS round-2 fire is the significant\nresult,\n but note its two deployment concessions: an identical-path host bind and a\n world-writable host staging path must be granted to the container (as an\napp\n manifest\u0027s hostPath grant would provide). The Unraid kernel survives\n(silent\n corruption \u2192 `insufficient replicas`); the TrueNAS\n crash is a **reliable image-delivered container\u2192host-kernel DoS** \u2014 no\nheap\n grooming required. IncusOS remains **BLOCKED** for this vector (shell-less\n appliance; no host bind-mount escape hatch). Full verdicts and evidence:\n `linux-research/.fleet-coord/oz4-oci-truenas2-verdict.md`,\n `linux-research/.fleet-coord/oz4-oci-unraid-verdict.md`;\n\n`linux-research/appliance-harness/truenas-scale/runs/20260725T193000Z/evidence/`,\n `linux-research/appliance-harness/unraid/runs/20260725T194343Z/evidence/`.\n- **2026-07-26 (OZ-4 OCI on IncusOS, round 2 \u2014 VALIDATED with ZERO host-side\n setup):** IncusOS flips from the fleet\u0027s only **BLOCKED** to\n**VALIDATED**,\n and the malicious-OCI-image vector now has a no-setup fire. The round-1\n blocker (host kernel resolves vdev paths in the host mount namespace;\n shell-less appliance precludes an admin bind mount) is defeated **without\n any bind**: the container\u0027s own rootfs necessarily exists on the host at\nthe\n predictable path\n`/var/lib/incus/storage-pools/local/containers/\u003cct\u003e/rootfs/`,\n so the image\u0027s payload at `/opt/d77.img` is host-resolvable by\nconstruction.\n A malicious OCI image launched as a **default unprivileged** container\n (default profile only \u2014 no `security.privileged`, no device add, no bind)\n carries a static raw `ZFS_IOC_POOL_TRYIMPORT` PoC (hand-packed nvlist,\n libzfs bypassed; `linux-research/incusos-spike/oz4-tryimport.c`,\nzg-poolop.c\n lineage) pointed at that host path; the ioctl is issued by **non-root uid\n 1000**, authorized via an image-controlled file capability\n (`cap_sys_admin+ep` on the payload binary \u2014 an attacker image property,\nnot\n an admin concession; verified differentially: cap cleared \u2192 `EPERM`). The\n armed import **wedges the host kernel\u0027s ZFS load path and storage stack**\n (`incusd` unresponsive, ioctl never returns; reproduced on a fresh\nkernel),\n while the structurally identical clean control imports in \u003c1s. Negative\n controls (wrong path, nonexistent path, cleared cap) all fail as expected.\n On this kernel the overflow surfaces as a **wedge/storage-DoS** rather\nthan\n TrueNAS\u0027s instant GPF-panic (heap-layout dependent); no root shell is\n claimed. Attacker preconditions: get the victim to launch the image as a\n default container; knowledge of the container name; nothing else. Full\n verdict and evidence:\n `linux-research/.fleet-coord/oz4-oci-incusos2-verdict.md`;\n `linux-research/incusos-spike/runs/20260726-oz4-oci2/evidence/`.\n- **2026-07-26 (OZ-4 OCI on TrueNAS SCALE, round 3 \u2014 VALIDATED with ZERO\n host-side setup, kernel panic):** the zero-wire rootfs-path vector fires\non\n TrueNAS SCALE 25.04.2.4 as well, upgrading round 2\u0027s concession-laden\nfire.\n A malicious OCI image launched as a **default unprivileged** Incus\ncontainer\n (dir storage backend, default profile only \u2014 no privileged flag, no device\n add, no bind, no host shell) carries the armed pool at `/opt/d77.img`, a\n static raw-ioctl PoC (`oz4ti`, zg-poolop/xpl-107-poolop lineage), and a\n **NATIVE-encoded** config nvlist naming the host-side rootfs path\n\n(`/var/lib/incus/storage-pools/default/containers/\u003cname\u003e/rootfs/opt/d77.img`,\n fully derivable from appliance defaults + the attacker-chosen container\n name). The import is issued by a **non-root** nested-userns user (host\n `UID: 2147001001`). The armed import **panicked the production kernel**\n (GPF in `__kmalloc` on `spa_tryimport \u2192 spa_load \u2192\n spa_ld_load_special_directories`, corrupted SLUB freelist; crashing task\n `Comm: oz4ti`), while the structurally identical clean control imported\n `rc="
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:49:48Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/40"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/40"
},
{
"url": "https://docs.qnap.com/operating-system/quts-hero/5.1.x/en-us/about-quts-hero-CAAE5DD0.html"
},
{
"url": "https://documentation.ubuntu.com/lxd/latest/howto/initialize/"
},
{
"url": "https://documentation.ubuntu.com/lxd/latest/reference/storage_zfs/"
},
{
"url": "https://github.com/ewindisch/linux-research-tracker/issues/26"
},
{
"url": "https://kernel.org/doc/html/next/process/threat-model.html"
},
{
"url": "https://linuxcontainers.org/incus/docs/main/reference/devices_unix_char/"
},
{
"url": "https://man7.org/linux/man-pages/man7/udev.7.html"
},
{
"url": "https://nixos.org/manual/nixos/stable/"
},
{
"url": "https://nixos.org/manual/nixos/stable/options"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://openzfs.github.io/openzfs-docs/Getting%20Started/Alpine%20Linux/index.html"
},
{
"url": "https://openzfs.github.io/openzfs-docs/Getting%20Started/Ubuntu/index.html"
},
{
"url": "https://openzfs.github.io/openzfs-docs/Getting%20Started/index.html"
},
{
"url": "https://packages.debian.org/trixie/zfs-dkms"
},
{
"url": "https://pbs.proxmox.com/docs/installation.html"
},
{
"url": "https://pbs.proxmox.com/docs/sysadmin.html#zfs-on-linux"
},
{
"url": "https://raw.githubusercontent.com/openzfs/zfs/master/udev/rules.d/90-zfs.rules.in"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://wiki.alpinelinux.org/wiki/ZFS"
},
{
"url": "https://wiki.ubuntu.com/Kernel/Reference/ZFS"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document"
},
{
"url": "https://www.first.org/cvss/v4.0/specification-document"
},
{
"url": "https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html#device-controller"
},
{
"url": "https://www.kernel.org/doc/html/latest/process/cve.html"
},
{
"url": "https://www.qnap.com/en-us/how-to/faq/article/why-should-i-avoid-using-raw-zfs-cli-commands-on-my-quts-hero-nas"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/40"
],
"discovery": "EXTERNAL"
},
"title": "OpenZFS Linux open zpool manipulation and escapes via unprivileged userns",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0098",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/40",
"automated": true,
"contentSha256": "3e93a580885da758a6b60cad4fcaddf02d82917807680d207d1ed45e0a793d55",
"evidenceScore": 10,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/40",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-16T18:31:49Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:22Z",
"dateUpdated": "2026-09-11T11:49:48Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0098"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79619 (GCVE-0-2026-79619)
Vulnerability from nvd – Published: 2026-08-26 12:50 – Updated: 2026-08-27 17:32
VLAI
EPSS
VEX
Title
OpenZFS: user-namespace capability check allows unprivileged local authorization bypass
Summary
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 15:47 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
6 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79619",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T15:47:13.454769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T15:47:19.764Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "OpenZFS",
"repo": "https://github.com/openzfs/zfs",
"vendor": "OpenZFS",
"versions": [
{
"lessThan": "2.2.11",
"status": "affected",
"version": "0.7.0",
"versionType": "semver"
},
{
"lessThan": "2.3.9",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
},
{
"lessThan": "2.4.4",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Erica Windisch"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Rob Norris"
}
],
"descriptions": [
{
"lang": "en",
"value": "On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:32:03.057Z",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/openzfs/zfs/pull/18959"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/advisories/GHSA-mhf5-q8gw-qg9v"
},
{
"tags": [
"product"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4"
},
{
"tags": [
"product"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9"
},
{
"tags": [
"product"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11"
},
{
"tags": [
"mailing-list"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/40"
}
],
"title": "OpenZFS: user-namespace capability check allows unprivileged local authorization bypass",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2026-79619",
"datePublished": "2026-08-26T12:50:10.502Z",
"dateReserved": "2026-08-25T08:10:52.983Z",
"dateUpdated": "2026-08-27T17:32:03.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-49298 (GCVE-0-2023-49298)
Vulnerability from nvd – Published: 2023-11-24 00:00 – Updated: 2025-11-03 19:28
VLAI
EPSS
VEX
Summary
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-10 20:36 UTC
CWE
- n/a
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
12 references
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:28:35.343Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/pull/15571"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/issues/15526"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308"
},
{
"tags": [
"x_transferred"
],
"url": "https://news.ycombinator.com/item?id=38405731"
},
{
"tags": [
"x_transferred"
],
"url": "https://web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.2.2"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs/"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.gentoo.org/917224"
},
{
"tags": [
"x_transferred"
],
"url": "https://news.ycombinator.com/item?id=38770168"
},
{
"name": "[debian-lts-announce] 20240318 [SECURITY] [DLA 3766-1] zfs-linux security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00009.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openzfs:openzfs:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "openzfs",
"vendor": "openzfs",
"versions": [
{
"lessThanOrEqual": "2.1.13",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.2.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-49298",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-10T20:36:55.286724Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T20:38:26.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-18T22:06:01.490Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/openzfs/zfs/pull/15571"
},
{
"url": "https://github.com/openzfs/zfs/issues/15526"
},
{
"url": "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308"
},
{
"url": "https://news.ycombinator.com/item?id=38405731"
},
{
"url": "https://web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files"
},
{
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.2.2"
},
{
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14"
},
{
"url": "https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs/"
},
{
"url": "https://bugs.gentoo.org/917224"
},
{
"url": "https://news.ycombinator.com/item?id=38770168"
},
{
"name": "[debian-lts-announce] 20240318 [SECURITY] [DLA 3766-1] zfs-linux security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-49298",
"datePublished": "2023-11-24T00:00:00.000Z",
"dateReserved": "2023-11-24T00:00:00.000Z",
"dateUpdated": "2025-11-03T19:28:35.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2013-20001 (GCVE-0-2013-20001)
Vulnerability from nvd – Published: 2021-02-12 00:00 – Updated: 2025-11-03 19:25
VLAI
EPSS
VEX
Summary
An issue was discovered in OpenZFS through 2.0.3. When an NFS share is exported to IPv6 addresses via the sharenfs feature, there is a silent failure to parse the IPv6 address data, and access is allowed to everyone. IPv6 restrictions from the configuration are not applied.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:25:13.751Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/issues/1894#issuecomment-30693652"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/releases"
},
{
"name": "[debian-lts-announce] 20240318 [SECURITY] [DLA 3766-1] zfs-linux security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in OpenZFS through 2.0.3. When an NFS share is exported to IPv6 addresses via the sharenfs feature, there is a silent failure to parse the IPv6 address data, and access is allowed to everyone. IPv6 restrictions from the configuration are not applied."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-18T22:06:03.072Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/openzfs/zfs/issues/1894#issuecomment-30693652"
},
{
"url": "https://github.com/openzfs/zfs/releases"
},
{
"name": "[debian-lts-announce] 20240318 [SECURITY] [DLA 3766-1] zfs-linux security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-20001",
"datePublished": "2021-02-12T00:00:00.000Z",
"dateReserved": "2021-02-12T00:00:00.000Z",
"dateUpdated": "2025-11-03T19:25:13.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-24716 (GCVE-0-2020-24716)
Vulnerability from nvd – Published: 2020-08-27 18:03 – Updated: 2024-08-04 15:19
VLAI
EPSS
VEX
Summary
OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://jira.ixsystems.com/browse/NAS-107270 | x_refsource_MISC |
| https://github.com/openzfs/zfs/commit/716b53d0a14… | x_refsource_MISC |
| https://reviews.freebsd.org/D26107 | x_refsource_MISC |
| https://github.com/openzfs/zfs/compare/zfs-0.8.4.… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:19:09.340Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://reviews.freebsd.org/D26107"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-27T18:03:32.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://reviews.freebsd.org/D26107"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24716",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jira.ixsystems.com/browse/NAS-107270",
"refsource": "MISC",
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"name": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f",
"refsource": "MISC",
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"name": "https://reviews.freebsd.org/D26107",
"refsource": "MISC",
"url": "https://reviews.freebsd.org/D26107"
},
{
"name": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1",
"refsource": "MISC",
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-24716",
"datePublished": "2020-08-27T18:03:32.000Z",
"dateReserved": "2020-08-27T00:00:00.000Z",
"dateUpdated": "2024-08-04T15:19:09.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-24717 (GCVE-0-2020-24717)
Vulnerability from nvd – Published: 2020-08-27 18:03 – Updated: 2024-08-04 15:19
VLAI
EPSS
VEX
Summary
OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://jira.ixsystems.com/browse/NAS-107270 | x_refsource_MISC |
| https://github.com/openzfs/zfs/commit/716b53d0a14… | x_refsource_MISC |
| https://reviews.freebsd.org/D26107 | x_refsource_MISC |
| https://github.com/openzfs/zfs/compare/zfs-0.8.4.… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:19:09.332Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://reviews.freebsd.org/D26107"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-27T18:03:21.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://reviews.freebsd.org/D26107"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24717",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jira.ixsystems.com/browse/NAS-107270",
"refsource": "MISC",
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"name": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f",
"refsource": "MISC",
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"name": "https://reviews.freebsd.org/D26107",
"refsource": "MISC",
"url": "https://reviews.freebsd.org/D26107"
},
{
"name": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1",
"refsource": "MISC",
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-24717",
"datePublished": "2020-08-27T18:03:21.000Z",
"dateReserved": "2020-08-27T00:00:00.000Z",
"dateUpdated": "2024-08-04T15:19:09.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-79619 (GCVE-0-2026-79619)
Vulnerability from cvelistv5 – Published: 2026-08-26 12:50 – Updated: 2026-08-27 17:32
VLAI
EPSS
VEX
Title
OpenZFS: user-namespace capability check allows unprivileged local authorization bypass
Summary
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 15:47 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
6 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79619",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T15:47:13.454769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T15:47:19.764Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "OpenZFS",
"repo": "https://github.com/openzfs/zfs",
"vendor": "OpenZFS",
"versions": [
{
"lessThan": "2.2.11",
"status": "affected",
"version": "0.7.0",
"versionType": "semver"
},
{
"lessThan": "2.3.9",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
},
{
"lessThan": "2.4.4",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Erica Windisch"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Rob Norris"
}
],
"descriptions": [
{
"lang": "en",
"value": "On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:32:03.057Z",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/openzfs/zfs/pull/18959"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/advisories/GHSA-mhf5-q8gw-qg9v"
},
{
"tags": [
"product"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4"
},
{
"tags": [
"product"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9"
},
{
"tags": [
"product"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11"
},
{
"tags": [
"mailing-list"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/40"
}
],
"title": "OpenZFS: user-namespace capability check allows unprivileged local authorization bypass",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2026-79619",
"datePublished": "2026-08-26T12:50:10.502Z",
"dateReserved": "2026-08-25T08:10:52.983Z",
"dateUpdated": "2026-08-27T17:32:03.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-49298 (GCVE-0-2023-49298)
Vulnerability from cvelistv5 – Published: 2023-11-24 00:00 – Updated: 2025-11-03 19:28
VLAI
EPSS
VEX
Summary
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-10 20:36 UTC
CWE
- n/a
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
12 references
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:28:35.343Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/pull/15571"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/issues/15526"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308"
},
{
"tags": [
"x_transferred"
],
"url": "https://news.ycombinator.com/item?id=38405731"
},
{
"tags": [
"x_transferred"
],
"url": "https://web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.2.2"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs/"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.gentoo.org/917224"
},
{
"tags": [
"x_transferred"
],
"url": "https://news.ycombinator.com/item?id=38770168"
},
{
"name": "[debian-lts-announce] 20240318 [SECURITY] [DLA 3766-1] zfs-linux security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00009.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openzfs:openzfs:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "openzfs",
"vendor": "openzfs",
"versions": [
{
"lessThanOrEqual": "2.1.13",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.2.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-49298",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-10T20:36:55.286724Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T20:38:26.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-18T22:06:01.490Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/openzfs/zfs/pull/15571"
},
{
"url": "https://github.com/openzfs/zfs/issues/15526"
},
{
"url": "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308"
},
{
"url": "https://news.ycombinator.com/item?id=38405731"
},
{
"url": "https://web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files"
},
{
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.2.2"
},
{
"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14"
},
{
"url": "https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs/"
},
{
"url": "https://bugs.gentoo.org/917224"
},
{
"url": "https://news.ycombinator.com/item?id=38770168"
},
{
"name": "[debian-lts-announce] 20240318 [SECURITY] [DLA 3766-1] zfs-linux security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-49298",
"datePublished": "2023-11-24T00:00:00.000Z",
"dateReserved": "2023-11-24T00:00:00.000Z",
"dateUpdated": "2025-11-03T19:28:35.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2013-20001 (GCVE-0-2013-20001)
Vulnerability from cvelistv5 – Published: 2021-02-12 00:00 – Updated: 2025-11-03 19:25
VLAI
EPSS
VEX
Summary
An issue was discovered in OpenZFS through 2.0.3. When an NFS share is exported to IPv6 addresses via the sharenfs feature, there is a silent failure to parse the IPv6 address data, and access is allowed to everyone. IPv6 restrictions from the configuration are not applied.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:25:13.751Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/issues/1894#issuecomment-30693652"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/releases"
},
{
"name": "[debian-lts-announce] 20240318 [SECURITY] [DLA 3766-1] zfs-linux security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in OpenZFS through 2.0.3. When an NFS share is exported to IPv6 addresses via the sharenfs feature, there is a silent failure to parse the IPv6 address data, and access is allowed to everyone. IPv6 restrictions from the configuration are not applied."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-18T22:06:03.072Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/openzfs/zfs/issues/1894#issuecomment-30693652"
},
{
"url": "https://github.com/openzfs/zfs/releases"
},
{
"name": "[debian-lts-announce] 20240318 [SECURITY] [DLA 3766-1] zfs-linux security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-20001",
"datePublished": "2021-02-12T00:00:00.000Z",
"dateReserved": "2021-02-12T00:00:00.000Z",
"dateUpdated": "2025-11-03T19:25:13.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-24716 (GCVE-0-2020-24716)
Vulnerability from cvelistv5 – Published: 2020-08-27 18:03 – Updated: 2024-08-04 15:19
VLAI
EPSS
VEX
Summary
OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://jira.ixsystems.com/browse/NAS-107270 | x_refsource_MISC |
| https://github.com/openzfs/zfs/commit/716b53d0a14… | x_refsource_MISC |
| https://reviews.freebsd.org/D26107 | x_refsource_MISC |
| https://github.com/openzfs/zfs/compare/zfs-0.8.4.… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:19:09.340Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://reviews.freebsd.org/D26107"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-27T18:03:32.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://reviews.freebsd.org/D26107"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24716",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jira.ixsystems.com/browse/NAS-107270",
"refsource": "MISC",
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"name": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f",
"refsource": "MISC",
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"name": "https://reviews.freebsd.org/D26107",
"refsource": "MISC",
"url": "https://reviews.freebsd.org/D26107"
},
{
"name": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1",
"refsource": "MISC",
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-24716",
"datePublished": "2020-08-27T18:03:32.000Z",
"dateReserved": "2020-08-27T00:00:00.000Z",
"dateUpdated": "2024-08-04T15:19:09.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-24717 (GCVE-0-2020-24717)
Vulnerability from cvelistv5 – Published: 2020-08-27 18:03 – Updated: 2024-08-04 15:19
VLAI
EPSS
VEX
Summary
OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://jira.ixsystems.com/browse/NAS-107270 | x_refsource_MISC |
| https://github.com/openzfs/zfs/commit/716b53d0a14… | x_refsource_MISC |
| https://reviews.freebsd.org/D26107 | x_refsource_MISC |
| https://github.com/openzfs/zfs/compare/zfs-0.8.4.… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:19:09.332Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://reviews.freebsd.org/D26107"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-27T18:03:21.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://reviews.freebsd.org/D26107"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24717",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jira.ixsystems.com/browse/NAS-107270",
"refsource": "MISC",
"url": "https://jira.ixsystems.com/browse/NAS-107270"
},
{
"name": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f",
"refsource": "MISC",
"url": "https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f"
},
{
"name": "https://reviews.freebsd.org/D26107",
"refsource": "MISC",
"url": "https://reviews.freebsd.org/D26107"
},
{
"name": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1",
"refsource": "MISC",
"url": "https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-24717",
"datePublished": "2020-08-27T18:03:21.000Z",
"dateReserved": "2020-08-27T00:00:00.000Z",
"dateUpdated": "2024-08-04T15:19:09.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}