{"id":"CVE-2023-49298","aliases":["ALPINE-CVE-2023-49298","DEBIAN-CVE-2023-49298","DLA-3766-1","DLA-4114-1","EUVD-2023-53284","GHSA-mvg7-8xh2-47rf","UBUNTU-CVE-2023-49298"],"status":"published","title":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that...","description":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01158,"percentile":0.67487,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639"],"published":"2023-11-24T00:00:00Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"zfs","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"zfs","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"zfs","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zfs","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zfs","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zfs","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"zfs-lts","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"zfs-lts","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"zfs-lts","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zfs-lts","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zfs-lts","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zfs-lts","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"zfs-rpi","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"zfs-rpi","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"zfs-rpi","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zfs-rpi","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zfs-rpi","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zfs-rpi","fixed_in":["2.2.1-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"zfs-linux","fixed_in":["2.1.11-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zfs-linux","fixed_in":["2.1.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zfs-linux","fixed_in":["2.1.14-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"zfs-linux","fixed_in":["0.8.3-1ubuntu12.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"zfs-linux","fixed_in":["2.1.5-1ubuntu6~22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"zfs-linux","fixed_in":["2.2.2-0ubuntu2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"zfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"zfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"zfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"zfs-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"zfs-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"zfs-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zfs-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zfs-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zfs-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"zfs-rpi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"zfs-rpi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"zfs-rpi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zfs-rpi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zfs-rpi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zfs-rpi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-1+deb12u1"}]}],"versions":["0.6.5.10-1","0.6.5.11-1","0.6.5.11-1~bpo8+1","0.6.5.11-1~bpo9+1","0.6.5.5-1","0.6.5.6-1","0.6.5.6-2","0.6.5.7-1","0.6.5.7-2","0.6.5.7-2~bpo8+1","0.6.5.8-1","0.6.5.8-1~bpo8+1","0.6.5.8-2","0.6.5.8-2~bpo8+1","0.6.5.8-3","0.6.5.9-1","0.6.5.9-2","0.6.5.9-2~bpo8+1","0.6.5.9-3","0.6.5.9-4","0.6.5.9-5","0.6.5.9-5+sparc64","0.6.5.9-5~bpo8+1","0.7.11-1","0.7.11-1~bpo8+1","0.7.11-1~bpo9+1","0.7.11-2","0.7.11-3","0.7.12-1","0.7.12-1~bpo9+1","0.7.12-2","0.7.12-3","0.7.12-4","0.7.12-5","0.7.13-1","0.7.13-1~bpo10+1","0.7.13-1~bpo9+1","0.7.3-1","0.7.3-2","0.7.3-3","0.7.3-3~bpo8+1","0.7.3-3~bpo9+1","0.7.4-1","0.7.4-1~bpo8+1","0.7.4-1~bpo9+1","0.7.5-1","0.7.5-1~bpo9+1","0.7.6-1","0.7.6-1~bpo8+1","0.7.6-1~bpo9+1","0.7.9-0.1","0.7.9-1","0.7.9-2","0.7.9-3","0.7.9-3~bpo8+1","0.7.9-3~bpo9+1","0.8.0-1","0.8.0-2","0.8.0~rc3-1","0.8.0~rc4-1","0.8.1-1","0.8.1-2","0.8.1-3","0.8.1-4","0.8.1-4~bpo10+1","0.8.2-1","0.8.2-2","0.8.2-2~bpo10+1","0.8.2-3","0.8.2-3~bpo10+1","0.8.2-4","0.8.2-5","0.8.3-1","0.8.3-1~bpo10+1","0.8.3-2","0.8.4-1","0.8.4-1~bpo10+1","0.8.4-2","0.8.4-2~bpo10+1","0.8.5-1","0.8.5-2","0.8.5-2~bpo10+1","0.8.5-3","0.8.5-3~bpo10+1","0.8.6-1","0.8.6-1~bpo10+1","2.0.0-1~exp1","2.0.1-1","2.0.1-1~exp1","2.0.1-2","2.0.1-3","2.0.2-1","2.0.2-1~bpo10+1","2.0.3-1","2.0.3-1~bpo10+1","2.0.3-2","2.0.3-3","2.0.3-4","2.0.3-5","2.0.3-6","2.0.3-7","2.0.3-8","2.0.3-8~bpo10+1","2.0.3-9","2.0.3-9~bpo10+1","2.0.6-1","2.0.6-1~bpo10+1","2.0.6-1~bpo11+1","2.0.6-2","2.0.7-1~bpo10+1","2.1.1-1","2.1.1-2","2.1.1-3","2.1.11-1","2.1.11-1~bpo11+1","2.1.2-1","2.1.2-1~bpo11+1","2.1.4-1","2.1.4-1~bpo11+1","2.1.5-1","2.1.5-1~bpo11+1","2.1.6-1","2.1.6-2","2.1.6-3","2.1.6-3~bpo11+1","2.1.7-1","2.1.7-1~bpo11+1","2.1.7-2","2.1.8-1","2.1.9-1","2.1.9-1~bpo11+1","2.1.9-2","2.1.9-3","2.1.9-3~bpo11+1","2.1.9-4"]},{"source":"osv","ecosystem":"Debian:13","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.14-1"}]}],"versions":["0.6.5.10-1","0.6.5.11-1","0.6.5.11-1~bpo8+1","0.6.5.11-1~bpo9+1","0.6.5.5-1","0.6.5.6-1","0.6.5.6-2","0.6.5.7-1","0.6.5.7-2","0.6.5.7-2~bpo8+1","0.6.5.8-1","0.6.5.8-1~bpo8+1","0.6.5.8-2","0.6.5.8-2~bpo8+1","0.6.5.8-3","0.6.5.9-1","0.6.5.9-2","0.6.5.9-2~bpo8+1","0.6.5.9-3","0.6.5.9-4","0.6.5.9-5","0.6.5.9-5+sparc64","0.6.5.9-5~bpo8+1","0.7.11-1","0.7.11-1~bpo8+1","0.7.11-1~bpo9+1","0.7.11-2","0.7.11-3","0.7.12-1","0.7.12-1~bpo9+1","0.7.12-2","0.7.12-3","0.7.12-4","0.7.12-5","0.7.13-1","0.7.13-1~bpo10+1","0.7.13-1~bpo9+1","0.7.3-1","0.7.3-2","0.7.3-3","0.7.3-3~bpo8+1","0.7.3-3~bpo9+1","0.7.4-1","0.7.4-1~bpo8+1","0.7.4-1~bpo9+1","0.7.5-1","0.7.5-1~bpo9+1","0.7.6-1","0.7.6-1~bpo8+1","0.7.6-1~bpo9+1","0.7.9-0.1","0.7.9-1","0.7.9-2","0.7.9-3","0.7.9-3~bpo8+1","0.7.9-3~bpo9+1","0.8.0-1","0.8.0-2","0.8.0~rc3-1","0.8.0~rc4-1","0.8.1-1","0.8.1-2","0.8.1-3","0.8.1-4","0.8.1-4~bpo10+1","0.8.2-1","0.8.2-2","0.8.2-2~bpo10+1","0.8.2-3","0.8.2-3~bpo10+1","0.8.2-4","0.8.2-5","0.8.3-1","0.8.3-1~bpo10+1","0.8.3-2","0.8.4-1","0.8.4-1~bpo10+1","0.8.4-2","0.8.4-2~bpo10+1","0.8.5-1","0.8.5-2","0.8.5-2~bpo10+1","0.8.5-3","0.8.5-3~bpo10+1","0.8.6-1","0.8.6-1~bpo10+1","2.0.0-1~exp1","2.0.1-1","2.0.1-1~exp1","2.0.1-2","2.0.1-3","2.0.2-1","2.0.2-1~bpo10+1","2.0.3-1","2.0.3-1~bpo10+1","2.0.3-2","2.0.3-3","2.0.3-4","2.0.3-5","2.0.3-6","2.0.3-7","2.0.3-8","2.0.3-8~bpo10+1","2.0.3-9","2.0.3-9~bpo10+1","2.0.6-1","2.0.6-1~bpo10+1","2.0.6-1~bpo11+1","2.0.6-2","2.0.7-1~bpo10+1","2.1.1-1","2.1.1-2","2.1.1-3","2.1.11-1","2.1.11-1~bpo11+1","2.1.12-1","2.1.12-2","2.1.12-2~bpo12+1","2.1.13-1","2.1.13-1~bpo11+1","2.1.13-1~bpo12+1","2.1.13-2","2.1.13-2~bpo11+1","2.1.13-2~bpo12+1","2.1.14-1~bpo11+1","2.1.14-1~bpo12+1","2.1.2-1","2.1.2-1~bpo11+1","2.1.4-1","2.1.4-1~bpo11+1","2.1.5-1","2.1.5-1~bpo11+1","2.1.6-1","2.1.6-2","2.1.6-3","2.1.6-3~bpo11+1","2.1.7-1","2.1.7-1~bpo11+1","2.1.7-2","2.1.8-1","2.1.9-1","2.1.9-1~bpo11+1","2.1.9-2","2.1.9-3","2.1.9-3~bpo11+1","2.1.9-4"]},{"source":"osv","ecosystem":"Debian:14","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.14-1"}]}],"versions":["0.6.5.10-1","0.6.5.11-1","0.6.5.11-1~bpo8+1","0.6.5.11-1~bpo9+1","0.6.5.5-1","0.6.5.6-1","0.6.5.6-2","0.6.5.7-1","0.6.5.7-2","0.6.5.7-2~bpo8+1","0.6.5.8-1","0.6.5.8-1~bpo8+1","0.6.5.8-2","0.6.5.8-2~bpo8+1","0.6.5.8-3","0.6.5.9-1","0.6.5.9-2","0.6.5.9-2~bpo8+1","0.6.5.9-3","0.6.5.9-4","0.6.5.9-5","0.6.5.9-5+sparc64","0.6.5.9-5~bpo8+1","0.7.11-1","0.7.11-1~bpo8+1","0.7.11-1~bpo9+1","0.7.11-2","0.7.11-3","0.7.12-1","0.7.12-1~bpo9+1","0.7.12-2","0.7.12-3","0.7.12-4","0.7.12-5","0.7.13-1","0.7.13-1~bpo10+1","0.7.13-1~bpo9+1","0.7.3-1","0.7.3-2","0.7.3-3","0.7.3-3~bpo8+1","0.7.3-3~bpo9+1","0.7.4-1","0.7.4-1~bpo8+1","0.7.4-1~bpo9+1","0.7.5-1","0.7.5-1~bpo9+1","0.7.6-1","0.7.6-1~bpo8+1","0.7.6-1~bpo9+1","0.7.9-0.1","0.7.9-1","0.7.9-2","0.7.9-3","0.7.9-3~bpo8+1","0.7.9-3~bpo9+1","0.8.0-1","0.8.0-2","0.8.0~rc3-1","0.8.0~rc4-1","0.8.1-1","0.8.1-2","0.8.1-3","0.8.1-4","0.8.1-4~bpo10+1","0.8.2-1","0.8.2-2","0.8.2-2~bpo10+1","0.8.2-3","0.8.2-3~bpo10+1","0.8.2-4","0.8.2-5","0.8.3-1","0.8.3-1~bpo10+1","0.8.3-2","0.8.4-1","0.8.4-1~bpo10+1","0.8.4-2","0.8.4-2~bpo10+1","0.8.5-1","0.8.5-2","0.8.5-2~bpo10+1","0.8.5-3","0.8.5-3~bpo10+1","0.8.6-1","0.8.6-1~bpo10+1","2.0.0-1~exp1","2.0.1-1","2.0.1-1~exp1","2.0.1-2","2.0.1-3","2.0.2-1","2.0.2-1~bpo10+1","2.0.3-1","2.0.3-1~bpo10+1","2.0.3-2","2.0.3-3","2.0.3-4","2.0.3-5","2.0.3-6","2.0.3-7","2.0.3-8","2.0.3-8~bpo10+1","2.0.3-9","2.0.3-9~bpo10+1","2.0.6-1","2.0.6-1~bpo10+1","2.0.6-1~bpo11+1","2.0.6-2","2.0.7-1~bpo10+1","2.1.1-1","2.1.1-2","2.1.1-3","2.1.11-1","2.1.11-1~bpo11+1","2.1.12-1","2.1.12-2","2.1.12-2~bpo12+1","2.1.13-1","2.1.13-1~bpo11+1","2.1.13-1~bpo12+1","2.1.13-2","2.1.13-2~bpo11+1","2.1.13-2~bpo12+1","2.1.14-1~bpo11+1","2.1.14-1~bpo12+1","2.1.2-1","2.1.2-1~bpo11+1","2.1.4-1","2.1.4-1~bpo11+1","2.1.5-1","2.1.5-1~bpo11+1","2.1.6-1","2.1.6-2","2.1.6-3","2.1.6-3~bpo11+1","2.1.7-1","2.1.7-1~bpo11+1","2.1.7-2","2.1.8-1","2.1.9-1","2.1.9-1~bpo11+1","2.1.9-2","2.1.9-3","2.1.9-3~bpo11+1","2.1.9-4"]},{"source":"osv","ecosystem":"Debian:10","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.12-2+deb10u3"}]}],"versions":["0.6.5.10-1","0.6.5.11-1","0.6.5.11-1~bpo8+1","0.6.5.11-1~bpo9+1","0.6.5.5-1","0.6.5.6-1","0.6.5.6-2","0.6.5.7-1","0.6.5.7-2","0.6.5.7-2~bpo8+1","0.6.5.8-1","0.6.5.8-1~bpo8+1","0.6.5.8-2","0.6.5.8-2~bpo8+1","0.6.5.8-3","0.6.5.9-1","0.6.5.9-2","0.6.5.9-2~bpo8+1","0.6.5.9-3","0.6.5.9-4","0.6.5.9-5","0.6.5.9-5+sparc64","0.6.5.9-5~bpo8+1","0.7.11-1","0.7.11-1~bpo8+1","0.7.11-1~bpo9+1","0.7.11-2","0.7.11-3","0.7.12-1","0.7.12-1~bpo9+1","0.7.12-2","0.7.12-2+deb10u1","0.7.12-2+deb10u1~bpo9+1","0.7.12-2+deb10u2","0.7.3-1","0.7.3-2","0.7.3-3","0.7.3-3~bpo8+1","0.7.3-3~bpo9+1","0.7.4-1","0.7.4-1~bpo8+1","0.7.4-1~bpo9+1","0.7.5-1","0.7.5-1~bpo9+1","0.7.6-1","0.7.6-1~bpo8+1","0.7.6-1~bpo9+1","0.7.9-0.1","0.7.9-1","0.7.9-2","0.7.9-3","0.7.9-3~bpo8+1","0.7.9-3~bpo9+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-9+deb11u2"}]}],"versions":["0.6.5.10-1","0.6.5.11-1","0.6.5.11-1~bpo8+1","0.6.5.11-1~bpo9+1","0.6.5.5-1","0.6.5.6-1","0.6.5.6-2","0.6.5.7-1","0.6.5.7-2","0.6.5.7-2~bpo8+1","0.6.5.8-1","0.6.5.8-1~bpo8+1","0.6.5.8-2","0.6.5.8-2~bpo8+1","0.6.5.8-3","0.6.5.9-1","0.6.5.9-2","0.6.5.9-2~bpo8+1","0.6.5.9-3","0.6.5.9-4","0.6.5.9-5","0.6.5.9-5+sparc64","0.6.5.9-5~bpo8+1","0.7.11-1","0.7.11-1~bpo8+1","0.7.11-1~bpo9+1","0.7.11-2","0.7.11-3","0.7.12-1","0.7.12-1~bpo9+1","0.7.12-2","0.7.12-3","0.7.12-4","0.7.12-5","0.7.13-1","0.7.13-1~bpo10+1","0.7.13-1~bpo9+1","0.7.3-1","0.7.3-2","0.7.3-3","0.7.3-3~bpo8+1","0.7.3-3~bpo9+1","0.7.4-1","0.7.4-1~bpo8+1","0.7.4-1~bpo9+1","0.7.5-1","0.7.5-1~bpo9+1","0.7.6-1","0.7.6-1~bpo8+1","0.7.6-1~bpo9+1","0.7.9-0.1","0.7.9-1","0.7.9-2","0.7.9-3","0.7.9-3~bpo8+1","0.7.9-3~bpo9+1","0.8.0-1","0.8.0-2","0.8.0~rc3-1","0.8.0~rc4-1","0.8.1-1","0.8.1-2","0.8.1-3","0.8.1-4","0.8.1-4~bpo10+1","0.8.2-1","0.8.2-2","0.8.2-2~bpo10+1","0.8.2-3","0.8.2-3~bpo10+1","0.8.2-4","0.8.2-5","0.8.3-1","0.8.3-1~bpo10+1","0.8.3-2","0.8.4-1","0.8.4-1~bpo10+1","0.8.4-2","0.8.4-2~bpo10+1","0.8.5-1","0.8.5-2","0.8.5-2~bpo10+1","0.8.5-3","0.8.5-3~bpo10+1","0.8.6-1","0.8.6-1~bpo10+1","2.0.0-1~exp1","2.0.1-1","2.0.1-1~exp1","2.0.1-2","2.0.1-3","2.0.2-1","2.0.2-1~bpo10+1","2.0.3-1","2.0.3-1~bpo10+1","2.0.3-2","2.0.3-3","2.0.3-4","2.0.3-5","2.0.3-6","2.0.3-7","2.0.3-8","2.0.3-8~bpo10+1","2.0.3-9","2.0.3-9+deb11u1","2.0.3-9~bpo10+1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.4.2-0ubuntu1","0.6.5.3-0ubuntu2","0.6.5.3-0ubuntu3","0.6.5.3-0ubuntu4","0.6.5.3-0ubuntu5","0.6.5.3-0ubuntu6","0.6.5.4-0ubuntu1","0.6.5.4-0ubuntu2","0.6.5.4-0ubuntu3","0.6.5.4-0ubuntu4","0.6.5.4-0ubuntu5","0.6.5.4-0ubuntu6","0.6.5.6-0ubuntu5","0.6.5.6-0ubuntu6","0.6.5.6-0ubuntu7","0.6.5.6-0ubuntu8","0.6.5.6-0ubuntu9","0.6.5.6-0ubuntu10","0.6.5.6-0ubuntu12","0.6.5.6-0ubuntu13","0.6.5.6-0ubuntu14","0.6.5.6-0ubuntu15","0.6.5.6-0ubuntu16","0.6.5.6-0ubuntu17","0.6.5.6-0ubuntu18","0.6.5.6-0ubuntu19","0.6.5.6-0ubuntu20","0.6.5.6-0ubuntu21","0.6.5.6-0ubuntu23","0.6.5.6-0ubuntu24","0.6.5.6-0ubuntu25","0.6.5.6-0ubuntu26","0.6.5.6-0ubuntu27","0.6.5.6-0ubuntu28","0.6.5.6-0ubuntu29","0.6.5.6-0ubuntu30"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.5.11-1ubuntu3","0.6.5.11-1ubuntu4","0.6.5.11-1ubuntu5","0.6.5.11-1ubuntu6","0.7.5-1ubuntu2","0.7.5-1ubuntu3","0.7.5-1ubuntu4","0.7.5-1ubuntu5","0.7.5-1ubuntu6","0.7.5-1ubuntu7","0.7.5-1ubuntu8","0.7.5-1ubuntu9","0.7.5-1ubuntu10","0.7.5-1ubuntu11","0.7.5-1ubuntu12","0.7.5-1ubuntu13","0.7.5-1ubuntu14","0.7.5-1ubuntu15","0.7.5-1ubuntu16","0.7.5-1ubuntu16.2","0.7.5-1ubuntu16.3","0.7.5-1ubuntu16.4","0.7.5-1ubuntu16.6","0.7.5-1ubuntu16.7","0.7.5-1ubuntu16.8","0.7.5-1ubuntu16.9","0.7.5-1ubuntu16.10","0.7.5-1ubuntu16.11","0.7.5-1ubuntu16.12","0.7.5-1ubuntu16.12+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.3-1ubuntu12.17"}]}],"versions":["0.8.1-1ubuntu14","0.8.1-1ubuntu15","0.8.1-1ubuntu16","0.8.1-1ubuntu17","0.8.2-3ubuntu1","0.8.2-3ubuntu2","0.8.2-3ubuntu3","0.8.2-3ubuntu4","0.8.2-3ubuntu5","0.8.3-1ubuntu2","0.8.3-1ubuntu3","0.8.3-1ubuntu4","0.8.3-1ubuntu5","0.8.3-1ubuntu6","0.8.3-1ubuntu7","0.8.3-1ubuntu8","0.8.3-1ubuntu9","0.8.3-1ubuntu10","0.8.3-1ubuntu11","0.8.3-1ubuntu12","0.8.3-1ubuntu12.1","0.8.3-1ubuntu12.2","0.8.3-1ubuntu12.3","0.8.3-1ubuntu12.4","0.8.3-1ubuntu12.5","0.8.3-1ubuntu12.6","0.8.3-1ubuntu12.7","0.8.3-1ubuntu12.8","0.8.3-1ubuntu12.9","0.8.3-1ubuntu12.10","0.8.3-1ubuntu12.11","0.8.3-1ubuntu12.12","0.8.3-1ubuntu12.13","0.8.3-1ubuntu12.14","0.8.3-1ubuntu12.15","0.8.3-1ubuntu12.16"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-1ubuntu6~22.04.4"}]}],"versions":["2.0.6-1ubuntu2","2.0.6-1ubuntu3","2.1.2-1ubuntu1","2.1.2-1ubuntu2","2.1.2-1ubuntu3","2.1.4-0ubuntu0.1","2.1.5-1ubuntu6~22.04.1","2.1.5-1ubuntu6~22.04.2","2.1.5-1ubuntu6~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-0ubuntu2"}]}],"versions":["2.2.0~rc3-0ubuntu4","2.2.0-0ubuntu1","2.2.0-0ubuntu3","2.2.1-0ubuntu1","2.2.2-0ubuntu1"]}],"products":[{"vendor":"openzfs","product":"openzfs"}],"references":[{"url":"https://github.com/openzfs/zfs/pull/15571","tags":["x_transferred","Exploit","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/openzfs/zfs/issues/15526","tags":["x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","report"]},{"url":"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308","tags":["x_transferred","Issue Tracking","Patch","report"]},{"url":"https://news.ycombinator.com/item?id=38405731","tags":["x_transferred","Patch","Third Party Advisory","web","report"]},{"url":"https://web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://github.com/openzfs/zfs/releases/tag/zfs-2.2.2","tags":["x_transferred","web","report"]},{"url":"https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14","tags":["x_transferred","web"]},{"url":"https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs/","tags":["x_transferred","web"]},{"url":"https://bugs.gentoo.org/917224","tags":["x_transferred","web"]},{"url":"https://news.ycombinator.com/item?id=38770168","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00009.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49298","tags":["advisory"]},{"url":"https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs"},{"url":"https://github.com/advisories/GHSA-mvg7-8xh2-47rf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-49298","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49298.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49298","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-49298","tags":["report"]},{"url":"https://gist.github.com/rincebrain/e23b4a39aba3fadc04db18574d30dc73","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49298","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-49298","description":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.","status":"published","published":"2023-11-24T00:00:00Z","modified":"2025-11-03T19:28:35.343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-53284","description":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.","status":"published","published":"2023-11-24T00:00:00Z","modified":"2025-11-03T19:28:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-mvg7-8xh2-47rf","title":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that...","description":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.","status":"published","published":"2023-11-24T21:30:28Z","modified":"2025-11-03T21:30:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:04:18.722049Z"}],"nvd":[{"id":"CVE-2023-49298","description":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.","status":"published","published":"2023-11-24T19:15:07.587Z","modified":"2026-06-17T06:35:47.88Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"ALPINE-CVE-2023-49298","description":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.","status":"published","published":"2023-11-24T19:15:07.587Z","modified":"2026-10-26T17:17:58.656316562Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"CVE-2023-49298","description":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.","status":"published","published":"2023-11-24T00:00:00Z","modified":"2026-10-28T02:30:39.639278345Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DEBIAN-CVE-2023-49298","description":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.","status":"published","published":"2023-11-24T19:15:07.587Z","modified":"2026-10-26T18:02:50.596559295Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-49298","description":"OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.","status":"published","published":"2023-11-24T19:15:00Z","modified":"2026-08-31T22:15:07.913140686Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"DLA-3766-1","title":"zfs-linux - security update","status":"published","published":"2024-03-19T00:00:00Z","modified":"2026-03-09T01:21:59.581188Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4114-1","title":"zfs-linux - security update","status":"published","published":"2025-04-05T00:00:00Z","modified":"2026-03-09T01:19:25.871642Z","updated_at":"2026-11-02T15:46:12.7027Z"}]}}