Veille CVE

‹ Retour à la liste

CVE-2026-79619

7.3 Élevée

Publiée le 26/08/2026 à 15:19 · Modifiée le 28/08/2026 à 17:24 · En attente d'analyse NVD · Source : security@ubuntu.com

Description

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
4.0 7.3 Élevée security@ubuntu.com CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Faiblesses (CWE)

Références

Ailleurs