xfsprogs was updated to fix one security vulnerability and bugs.

  - Handle unwanted data disclosure in xfs_metadump     (bsc#939367, CVE-2012-2150)

  - Fix definition of leaf attribute block to avoid gcc     optimization xfsprogs-fix-leaf-block-definition

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file data, which allows remote attackers     to obtain sensitive information by reading a generated image. (CVE-2012-2150)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-743:01 advisory.

    A set of commands to use the XFS filesystem, including mkfs.xfs.
    XFS is a high performance journaling filesystem which originated     on the SGI IRIX platform.  It is completely multi-threaded, can     support large files and large filesystems, extended attributes,     variable block sizes, is extent based, and makes extensive use of     Btrees (directories, extents, free space) to aid both performance     and scalability.
    Refer to the documentation at http://oss.sgi.com/projects/xfs/     for complete details.  This implementation is on-disk compatible     with the IRIX version of XFS.
    Security issues fixed with this release:
    CVE-2012-2150     xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file     data, which allows remote attackers to obtain sensitive information by     reading a generated image.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that the xfs_metadump tool of the xfsprogs suite did not fully adhere to the standards of obfuscation described in its man page. In case a user with the necessary privileges used xfs_metadump and relied on the advertised obfuscation, the generated data could contain unexpected traces of potentially sensitive information.

Gabriel Vlasiu reported that xfs_metadump, part of the xfsprogs suite of tools for the XFS filesystem, did not properly obfuscate data.
xfs_metadump properly obfuscates active metadata, but the rest of the space within that fs block comes through in the clear. This could lead to exposure of stale disk data via the produced metadump image.

The expectation of xfs_metadump is to obfuscate all but the shortest names in the metadata, as noted in the manpage :

By default, xfs_metadump obfuscates most file (regular file, directory and symbolic link) names and extended attribute names to allow the dumps to be sent without revealing confidential information. Extended attribute values are zeroed and no data is copied. The only exceptions are file or attribute names that are 4 or less characters in length.
Also file names that span extents (this can only occur with the mkfs.xfs(8) options where -n size > -b size) are not obfuscated. Names between 5 and 8 characters in length inclusively are partially obfuscated.

While the xfs_metadump tool can be run by unprivileged users, it requires appropriate permissions to access block devices (such as root) where the sensitive data might be dumped. An unprivileged user, without access to the block device, could not use this flaw to obtain sensitive data they would not otherwise have permission to access.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2151 advisory.

    - Fix xfs_metadump disclosure flaw, CVE-2012-2150  (#1251118)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
85610	openSUSE Security Update : xfsprogs (openSUSE-2015-555)	Nessus	SuSE Local Security Checks	2015/8/25	2021/1/19	medium
217660	Linux Distros Unpatched Vulnerability : CVE-2012-2150	Nessus	Misc.	2025/3/4	2025/9/4	high
291591	MiracleLinux 7 : xfsprogs-3.2.2-2.el7 (AXSA:2015-743:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high
87348	Amazon Linux AMI : xfsprogs (ALAS-2015-622)	Nessus	Amazon Linux Local Security Checks	2015/12/15	2018/4/18	medium
85549	Fedora 21 : xfsprogs-3.2.2-2.fc21 (2015-12406)	Nessus	Fedora Local Security Checks	2015/8/20	2021/1/11	medium
85358	Fedora 22 : xfsprogs-3.2.2-2.fc22 (2015-12435)	Nessus	Fedora Local Security Checks	2015/8/13	2021/1/11	medium
85548	Fedora 23 : xfsprogs-3.2.4-1.fc23 (2015-12380)	Nessus	Fedora Local Security Checks	2015/8/20	2021/1/11	medium
87025	Oracle Linux 7 : xfsprogs (ELSA-2015-2151)	Nessus	Oracle Linux Local Security Checks	2015/11/24	2024/10/23	high

检测

插件搜索

medium

high

high

medium

medium

medium

medium

high