FreeBSD ZFS: size truncation in ZFS_IOC_USERSPACE_MANY gives a local user a kernel heap overflow

Impact

The ZFS_IOC_USERSPACE_MANY ioctl behind zfs-userspace(8) truncates a 64-bit output buffer size to 32 bits when sizing the kernel allocation, then uses the untruncated 64-bit value as the write limit, so records run off the end of the allocation. A local user holding the delegated ZFS "userused" permission can drive this into a kernel heap overflow and potentially escalate to root. Where this matters for a GPU fleet is the FreeBSD-based storage node serving datasets and checkpoints: root there is root over every tenant's data. The precondition is narrow — it needs a local account with that specific delegation, and it is not reachable from an NFS or iSCSI client — so a single-purpose appliance with no untrusted local logins has close to no exposure.

Who can reach it

A local user on the FreeBSD host who holds the delegated "userused" ZFS permission. Authenticated and local only; not exploitable across the network or from a storage client.

What to do

FreeBSD SA-26:40.zfs carries the patch and the affected branches — apply the errata patch from there. It is a kernel-side fix, so the host needs to boot the fixed kernel; on a storage node that means failing over or taking exports offline for the reboot. If the node has no local accounts holding ZFS delegations, you can safely fold this into the next scheduled reboot rather than opening a window for it, and confirm that by reviewing zfs allow output on each pool.

References