[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <55B0FD01.1080602@redhat.com>
Date: Thu, 23 Jul 2015 08:41:05 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, david@...morbit.com
Subject: CVE-2012-2150 xfsprogs: xfs_metadump information disclosure flaw
https://bugzilla.redhat.com/show_bug.cgi?id=817696
Gabriel Vlasiu reported that xfs_metadump, part of the xfsprogs suite of
tools for the XFS filesystem, did not properly obfuscate data.
xfs_metadump properly obfuscates active metadata, but the rest of the
space within that fs block comes through in the clear. This could lead
to exposure of stale disk data via the produced metadump image.
The expectation of xfs_metadump is to obfuscate all but the shortest
names in the metadata, as noted in the manpage:
By default, xfs_metadump obfuscates most file (regular file,
directory and symbolic link) names and extended attribute names to
allow the dumps to be sent without revealing confidential
information. Extended attribute values are zeroed and no data is
copied. The only exceptions are file or attribute names that are 4 or
less characters in length. Also file names that span extents (this can
only occur with the mkfs.xfs(8) options where -n size > -b size) are not
obfuscated. Names between 5 and 8 characters in length
inclusively are partially obfuscated.
While the xfs_metadump tool can be run by unprivileged users, it
requires appropriate permissions to access block devices (such as root)
where the sensitive data might be dumped. An unprivileged user, without
access to the block device, could not use this flaw to obtain sensitive
data they would not otherwise have permission to access.
Upstream patches will be available at
https://git.kernel.org/cgit/fs/xfs/xfsprogs-dev.git/
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
