OpenZFS ioctl Authorization Bypass via Unprivileged Namespace

Executive Summary

This vulnerability allows an unprivileged local user on Linux to perform privileged OpenZFS operations by exploiting weak authorization checks in ioctl functions. These checks incorrectly treat capabilities from user-created namespaces as equivalent to host root privileges, enabling actions like pool creation, import, destruction, event log access, and fault injection without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if unprivileged users can perform ZFS administrative operations. Verify if /dev/zfs is accessible to non-root users and test if operations like zpool create or zpool events work without root privileges. Use commands like ls -l /dev/zfs to check permissions and zpool list to see accessible pools.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could gain unauthorized control over ZFS pools, manipulate data, inject faults, or extract sensitive information from event logs. This requires only the ability to open /dev/zfs and create user namespaces, which may be possible even without root access on vulnerable systems.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict access to /dev/zfs by setting proper permissions (e.g., chmod 600 /dev/zfs). Disable unprivileged user namespace creation if not required (check kernel parameters like kernel.unprivileged_userns_clone). Update OpenZFS to a patched version that enforces global zone scoping for administrative operations.

Useful 0 Not Useful 0