Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Jul 2015 08:41:05 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, david@...morbit.com
Subject: CVE-2012-2150 xfsprogs: xfs_metadump information disclosure flaw

https://bugzilla.redhat.com/show_bug.cgi?id=817696

Gabriel Vlasiu reported that xfs_metadump, part of the xfsprogs suite of
tools for the XFS filesystem, did not properly obfuscate data.
xfs_metadump properly obfuscates active metadata, but the rest of the
space within that fs block comes through in the clear.  This could lead
to exposure of stale disk data via the produced metadump image.

The expectation of xfs_metadump is to obfuscate all but the shortest
names in the metadata, as noted in the manpage:

By  default,  xfs_metadump  obfuscates  most  file (regular file,
directory and symbolic link) names and extended  attribute  names to
allow  the  dumps  to be sent without revealing confidential
information. Extended attribute values are zeroed and no data  is
copied.  The only exceptions are file or attribute names that are 4 or
less characters in length. Also file names that span extents (this can
only occur with the mkfs.xfs(8) options where -n size > -b size) are not
obfuscated.  Names between 5 and 8 characters  in length
inclusively are partially obfuscated.

While the xfs_metadump tool can be run by unprivileged users, it
requires appropriate permissions to access block devices (such as root)
where the sensitive data might be dumped.  An unprivileged user, without
access to the block device, could not use this flaw to obtain sensitive
data they would not otherwise have permission to access.

Upstream patches will be available at
https://git.kernel.org/cgit/fs/xfs/xfsprogs-dev.git/

-- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com


Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.