OpenZFS: ioctl checks accept unprivileged user-namespace capabilities, granting local pool admin

Impact

Several OpenZFS ioctl authorization checks treat a capability held inside a user-created namespace as if it were real host root, so any local user can perform pool administration: create, import and destroy pools, read the pool event log, and drive zinject fault injection. On a storage or head node where ZFS backs dataset scratch, model and image caches, or container image storage, an unprivileged tenant can destroy shared state that a whole training run depends on, or import a pool whose contents they control. The prerequisites are ordinary rather than exotic - permission to open /dev/zfs plus a kernel that allows unprivileged user namespaces, which is the default on most distributions. It is not by itself a container escape; a container is only exposed if /dev/zfs has been passed into it.

Who can reach it

A local unprivileged user on the host who can open /dev/zfs (governed by local device permissions) and create a user namespace. No authentication beyond a shell, no prior access to the target pool or its backing devices.

What to do

Upgrade to OpenZFS 2.2.11, 2.3.9, or 2.4.4. The fix is in the kernel module, so it does not take effect until the module is reloaded, and the module cannot be unloaded while pools are imported - in practice each affected node has to be drained and rebooted. Until then the two available mitigations are to tighten /dev/zfs device permissions so untrusted local users cannot open it, and to disable unprivileged user namespace creation on nodes where no workload needs them.

References

Related entries

• Xen on AMD - x86 HVM pagetable height update: AMD HVM guest OS users can trigger a data-structure access during aCVE-2019-19577 · Xen on AMD - x86 HVM pagetable height updateHigh
• IBM Spectrum Scale kernel module: An unauthenticated local trigger takes down the Spectrum Scale kernel module and withCVE-2020-4411 · IBM Spectrum Scale kernel moduleHigh
• Xen - x86 IOMMU command timeout detection and handling: Xen's IOMMU command timeout handling is inappropriate, so IOMMUCVE-2021-28692 · Xen - x86 IOMMU command timeout detection and handlingHigh
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2021-4460 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Xen (x86): Unintended memory sharing between guests - cross-tenant data exposureCVE-2022-42327 · Xen (x86)High
• Linux kernel (arch/x86/kvm): A guest that is not advertised long mode makes the host's SMM emulator walk 16CVE-2022-49883 · Linux kernel (arch/x86/kvm)High