From nobody Tue Dec 05 22:16:04 2023 X-Original-To: freebsd-announce@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4SlFH86Gtdz53WnK for ; Tue, 5 Dec 2023 22:16:04 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2610:1c1:1:6074::16:84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4SlFH82ztwz4dtT; Tue, 5 Dec 2023 22:16:04 +0000 (UTC) (envelope-from security-advisories@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1701814564; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=bqfXKnz//7RGTz3OwI9F0ZgYRF0oV7Bb4ckG/1JQDFI=; b=jQzSv++uTYK/m70P/yrOInNGcwweQkzs0iXwJIL1N9FKgSr8uzuEgBTiiSEof/VawJO5qn cq2tAFR+vPuCrXwYsEwnd54dhya4uJRrIHnUsikAeOBhSnkIh0U+6Lh7hCxGx8Cs5X108a cp6WjX+EsV6P665AfUoPt+ye6o0QrCVeQSZGjuHeSenjAVGvLRe9qT2M/HjcHdtaPX5zvr SrYBmC/TCSC4xcV1YNV7kE3ZTReTm8+GMFJ8gMaIPddnABre663tM4qcNyioIglLCGBC4v nuBfkCdFWs3ZG62UpWY/OfGR2yO9C12JGvneeep/aczc9Epw35V1buIdDTQfew== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1701814564; a=rsa-sha256; cv=none; b=svYlywcJHjKlEEhrxTdHDub1hQ4rjQfLOagdvfhi8R/CNY7rxdr9eTTP/YC3Ay9RR8pAB8 RQ+jhcuQhOUJj2iYuG2JNRcZ9HfmAo526d+wU1DtkfL1IKQO99z5xmIVyjXBcuUTwMC8gH 6THxC866ERvR5C3g7rs4q5mBBc4hWbfKNRkONXvds46laADjd53RJ7CWNKuLXVuqzFA3j2 qzXL2vax9EuwfEFs1QyRSYm+ZNan+tuoglFInaJz2cm3hmcl1cJeOZB6ADoZOt/D/bSgpW qqoNnNXgqWHVJpr5D/NiGSutHEx7V/ksDrNahGT+WiU8ebeT9KP4OrHsCXKgeg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1701814564; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=bqfXKnz//7RGTz3OwI9F0ZgYRF0oV7Bb4ckG/1JQDFI=; b=tH4ktMTO597X3mbHdIk7cM9HO2yA1r2hYFEFCnnCe0ivQKkuY9pGigTGOOBAhe3uebPifx cFosXrW9bccPduRXxo3RoLO0lHUD4fEoIaIV++Zs2PacVUHPedm/RQIfOH0E3xLe6FVVVi RlBOWF6wmJdZC55JgDBWvySG3VlEYfHVlbW8Ek1t2ioDGMDctX1t/H/T61jy9qq0zFqI6f P3aoMqPEH67s1Fa0xlOVf+4Cv9vmvhDT7LQ8UX1cWlxo14Bb2g5nB0AlDJVJVsU2YNdnqw CweJ6/o+MGF7CvQsD4RWLkjKPDUQowC+kdiJkkKo3sGyF9Jn6UNyYAWhag4blw== Received: by freefall.freebsd.org (Postfix, from userid 945) id 4B2A514F94; Tue, 5 Dec 2023 22:16:04 +0000 (UTC) From: FreeBSD Errata Notices To: FreeBSD Errata Notices Subject: FreeBSD Errata Notice FreeBSD-EN-23:22.vfs Reply-To: freebsd-stable@freebsd.org Precedence: bulk Message-Id: <20231205221604.4B2A514F94@freefall.freebsd.org> Date: Tue, 5 Dec 2023 22:16:04 +0000 (UTC) List-Id: Project Announcements [moderated] List-Archive: https://lists.freebsd.org/archives/freebsd-announce List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-announce@freebsd.org X-BeenThere: freebsd-announce@freebsd.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-23:22.vfs Errata Notice The FreeBSD Project Topic: ZFS snapshot directories not accessible over NFS Category: core Module: vfs Announced: 2023-12-05 Affects: FreeBSD 14.0 Corrected: 2023-12-01 13:27:28 UTC (stable/14, 14.0-STABLE) 2023-12-05 18:27:40 UTC (releng/14.0, 14.0-RELEASE-p2) 2023-12-04 21:03:42 UTC (stable/13, 13.2-STABLE) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background ZFS is one of several filesystems available on FreeBSD. ZFS supports many advanced features, including checksumming, transparent compression, and snapshots. Snapshots of a ZFS dataset can be accessed through a hidden directory, .zfs/snapshots, located in the root of the mounted dataset. II. Problem Description When a process attempts to access a snapshot under //.zfs/snapshot, the snapshot is automounted. However, without this patch, the automount does not properly set some metadata in the kernel's representation of the mount point, which results in the snapshot not being accessible over NFS. III. Impact Workflows which rely on ZFS snapshots being accessible over NFS are broken. IV. Workaround No workaround is available. V. Solution Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. A reboot is required after the upgrade procedure has been completed. Perform one of the following: 1) To update your system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platfrom on FreeBSD 13 and earlier, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r now 2) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/EN-23:22/vfs.patch # fetch https://security.FreeBSD.org/patches/EN-23:22/vfs.patch.asc # gpg --verify vfs.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash or Subversion revision number in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/14/ 62304a0c3b8b stable/14-n265867 releng/14.0/ 889ecd8fd178 releng/14.0-n265394 stable/13/ 00f0b99e63c3 stable/13-n256835 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmVvmWkACgkQbljekB8A Gu+7TBAAt31ElRhk83oPelDQ0Trq1ngDk7qWabeG+ODjS6mptke5mqBn0ZvFyTNb z+x6biXUGnE9o9P4T0mdE/euSGSHQWASU+DwycRqkEM4Xo7rMWrheOGwFBJ+1g/z ZQyowYL8HRIOQ7Ijal1NTZ2S/HpAvXdyuGsxYYimyZyckOAe+ZzmUiCmlvvLJCdk m8uUnRidevXWiUrRW9MNBHG5XoNwT7je5KT/RxqqeJQ4ObWEywjsHxwZn1Px1vQw ycjbL82sKrv2FiXf2FdvC2xbji5QkrLTf+EOecreTKaiyMcooT9h+ZQUiRj3ChbW KHszVdwYrGmDx9OOq+JWWqf+KgEfmiisFQsqHpq4Zc4RTKhPwAV/PX7+cLvBlX85 QgNupyGLkwOkrAb3hdC7dsPTZl4htFJzC49CDH4IZNIJxQ7pTa0LDujyybacnYE+ reCe6DZ5aY+TULHlCTfGZ21OcpiEDrCmvFoZhZHuEZxMl9LjIf1jjpGPFP+lPJ7u nG5VXRjFfFdGtuiyfzs4UsYD5XOn+hgcZl8vkMgfXQU0LwPyKHxo3k+vg5rdxImI HWZPYlo6D+lrtIBW3LLjiHrhHrekruqN2RT8cmkSOftihLdNuO8KC72DE0Co/D49 QeVeOv5tkNyc0/M7TVEYapIYGCTb5VpawZNyr6ABLwnXDyQ8rck= =ufsO -----END PGP SIGNATURE-----