Heap Overflow in ZFS via ZFS_IOC_USERSPACE_MANY ioctl

Executive Summary

This vulnerability involves a kernel heap overflow in the ZFS_IOC_USERSPACE_MANY ioctl due to a 64-bit buffer size being truncated to 32-bit for kernel allocation but used as a 64-bit limit when writing records. A local user with the 'userused' delegated ZFS permission can exploit this to trigger a heap overflow and potentially escalate privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can only be detected by checking the ZFS version and patch status on systems running OpenZFS. Use commands like 'zfs version' or 'pkg info zfs' to verify if your system is affected. Systems not using ZFS are unaffected.

Useful 0 Not Useful 0

Impact Analysis

If you are a local user with 'userused' delegated ZFS permissions on a vulnerable system, an attacker could exploit this flaw to execute arbitrary code in the kernel, leading to privilege escalation. This could allow unauthorized access to sensitive data or system control.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local users with specific ZFS permissions to escalate privileges via kernel heap overflow. While not directly impacting GDPR or HIPAA compliance, such privilege escalation could lead to unauthorized data access or modification, potentially violating these regulations if sensitive data is involved.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade affected systems to patched OpenZFS versions dated after June 30, 2026, using pkg, freebsd-update, or source patches. Reboot the system after applying updates. Systems not using ZFS require no action.

Useful 0 Not Useful 0