Read the docs
TI-2023-26934 Aliases CVE-2023-49298GHSA-mvg7-8xh2-47rf

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving…

Priority HIGH 72CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-639.

Summary

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01158 67th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:openzfs:openzfs:*:*:*:*:*:*:*:*up to 2.1.13VulnerableOpenZFS
cpe:2.3:a:openzfs:openzfs:2.2.0:-:*:*:*:*:*:*2.2.0VulnerableOpenZFS
cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*14.0Running onFreeBSD
  • cpe:2.3:a:openzfs:openzfs:*:*:*:*:*:*:*:* Versions up to 2.1.13 Vulnerable ·OpenZFS
  • cpe:2.3:a:openzfs:openzfs:2.2.0:-:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·OpenZFS
  • cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:* Versions 14.0 Running on ·FreeBSD

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49298
  2. 2026-10-03 Alias added: GHSA-mvg7-8xh2-47rf

References

Exploit 2

Patch 2

Advisory 1

Other 6

  • TI-2013-06216 An issue was discovered in OpenZFS through 2.0.3. CVSS 3.1HIGH 7.5
  • TI-2020-15174 OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories. CVSS 3.1HIGH 7.8
  • TI-2020-15175 OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences