CyberRota Analysis
AI-GeneratedSeveral OpenZFS ioctl authorization checks on Linux improperly equate capabilities from user-created, unprivileged namespaces with real host privileges, allowing unprivileged local users to execute critical pool-administrative operations such as creating, importing, or destroying pools, as well as accessing event logs and injecting faults. This vulnerability poses a significant risk as it requires minimal permissions to exploit, specifically access to /dev/zfs and the ability to create unprivileged user namespaces. Organizations utilizing OpenZFS on Linux should prioritize patching this vulnerability to mitigate the potential for unauthorized access and manipulation of storage pools.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.