ZFS Dataset Property Injection via ZFS_IOC_SET_PROP

Executive Summary

This vulnerability allows any local user to set an internal ZFS metadata flag called $hasrecvd on datasets using the ZFS_IOC_SET_PROP ioctl. The ioctl incorrectly validated the calling user, enabling unprivileged users to manipulate dataset metadata as if it had received properties from a zfs-recv stream.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized setting of the $hasrecvd metadata flag on ZFS datasets. Use the command 'zfs get all' to inspect dataset properties for unexpected $hasrecvd flags. Compare with known good configurations or recent changes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to falsify dataset metadata, potentially misleading system administrators about the origin or state of datasets. This might lead to incorrect assumptions about data integrity or backup status, though it does not directly grant elevated privileges or data access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by allowing tampering with dataset metadata, which might affect audit trails or data provenance records. Organizations relying on ZFS for data integrity should assess whether this could lead to non-compliance with data protection or record-keeping requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade affected systems to patched ZFS versions dated after June 30, 2026, using pkg, freebsd-update, or source patches. Reboot the system after applying updates. If ZFS is not used, no action is required.

Useful 0 Not Useful 0