[Pkg-zfsonlinux-devel] Bug#1056752: Bug#1056752: CVE-2023-49298 also affect Bullseye and Bookworm

[Aron Xu]

Hi,

On Sat, Dec 2, 2023 at 3:51 PM Roman Veselý <roman at liten.cz> wrote:
>
> Dear Maintainers,
>
> The bug CVE-2023-49298 is here: https://tracker.debian.org/pkg/zfs-linux
> marked as LOW PRIORITY for Bullseye and Bookworm.
>
> Are you planning to fix this bug in Bullseye and Bookworm soon?
>
> For many users, the fix is important - if the official Debian fix will take longer,
> it's good to know and make the fix yourself.
>
> Thank you for your support for ZFS in Debian,
>

The fix will land in bookworm-backports and bullseye-backports-sloppy
shortly after 2.1.14-1 migrates to testing, which will take about 2
days hopefully. Fixes to 2.0.3-9+deb11u1 (bullseye) and 2.1.11-1
(bookworm) are planned but will likely take more time.

Such an issue is marked low-priority because the bug itself isn't
urgent from a security update point of view, which means an attacker
can only cause damage in rare cases. It's still recommended to update
or at least apply mitigations to the problem (by setting
zfs_dmu_offset_next_sync to 0 on bookworm) to avoid potential data
loss.

Thanks,
Aron