Detections
Analytics

Fedora 45 : btrfs-backup-ng (2026-344a8310cc)

high Nessus Plugin ID 374658

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-344a8310cc advisory.

 notes=Update to 0.9.18, which carries the 0.9.17 security fix (GHSA-5xvm-66c9-p5ph) and a fix for a regression in 0.9.17. 0.9.17 was not shipped to this release.

 Security: the lock store created directories, wrote holder records and read them back with operations that followed a symbolic link. If the lock-store directory on a backup location was writable by another local account, a planted symlink could redirect those writes and reads; with a backup run as root, as a scheduled backup usually is, that let a less privileged local user steer a root write or read.
 Locally the lock store now works on O_NOFOLLOW file descriptors, and over ssh each directory component is created with a plain mkdir, records are written under set -C, and a record that is a link or not a regular file is refused.

 Breaking: a lock-store directory writable by its group or by everyone is now refused with an error naming the directory and the remedy (chmod go-w <path>). A store created by an earlier version under an interactive umask 002 is mode 0775 and will be refused until tightened;
 stores created by a root timer or over ssh are 0755 and unaffected.
 New stores are created 0755 regardless of umask.

 0.9.18 fixes the 0.9.17 regression where every exclusive lock on a local btrfs destination on kernel 6.6 or newer failed with remote lock ... is busy, so a receive or prune into a local btrfs location could not run.

 This update includes all changes since 0.9.16.

 Advisory:
 https://github.com/berrym/btrfs-backup-ng/security/advisories/GHSA-5xvm-66c9-p5ph Full changelog:
 https://github.com/berrym/btrfs-backup-ng/blob/v0.9.18/CHANGELOG.md

 ----

 Update to 0.9.16.

 - A source could keep a snapshot forever and send it again in full on every run; fixed on the first run after upgrading.
 - On a root-owned destination with ssh_sudo, locks went stale while a transfer was still running; the heartbeat now elevates like the acquire (expect one sudo -n sh -c per beat in the sudo log).
 - restore --unlock no longer erases a pin a running restore has just taken.
 - doctor reports who holds each pin, and --fix repairs only what it can prove is stale.

 A .btrfs-backup-ng.locks.holders directory now appears beside each lock file; it is runtime state, and older versions ignore it.

 This update includes all changes since 0.9.12.

 Full changelog:
 https://github.com/berrym/btrfs-backup-ng/blob/v0.9.16/CHANGELOG.md

 ----

 Update to 0.9.15.

 - Pins on the source could be lost or left behind when several targets sent in parallel; fixed.
 - A compressed ssh:// backup to a remote without the decompressor is refused before the transfer starts, instead of failing after the stream has been sent.
 - estimate exits 2 when it could not measure and 3 when the destination is short of space (it exited 0), and can now measure an ssh:// source.
 - Pins on the source could be lost or left behind when several targets sent in parallel; fixed. Backups on the targets were not affected

 This update includes all changes since 0.9.12, including 0.9.13's fixes for systems without sudo, openssl or bash as sh.

 Full changelog:
 https://github.com/berrym/btrfs-backup-ng/blob/v0.9.15/CHANGELOG.md

 ----

 Update to 0.9.14.

 Fixes the test suite failing at startup with pytest older than 8.4 (upstream #121). There are no changes to the program itself.
 0.9.14 also includes all of 0.9.13's fixes.

 Full changelog:
 https://github.com/berrym/btrfs-backup-ng/blob/v0.9.14/CHANGELOG.md

 ----

 Update to 0.9.13.

 This release fixes failures on systems without the usual privileges or tools:

 - A compressed backup to an ssh:// target whose remote sh is dash 0.5.13.0-0.5.13.4 failed. Nothing was written, and existing backups are not affected.
 - A machine without sudo failed with No such file or directory:
 'sudo'. It now says what is needed; run stops at startup and doctor reports it.
 - Size estimates failed when sudo refused or was missing, although the snapshot was readable. du is now retried as the user.
 - A restore without openssl reported a missing passphrase instead of the missing program.

 Changes you may notice after upgrading:

 - config validate and doctor now check the snapper configuration and snapshot_dir that run depends on, so they can report an error for a configuration they accepted before.
 - A space check based on a du figure (an upper bound) warns and proceeds instead of refusing.
 - A sudo password containing a line break is refused with a message saying why.
 - doctor has a new local_privilege check.

 Packaging: the package now requires lzop (the program used for lzo compression) instead of the lzo library, and the build runs the full test suite, including the compression tests.

 Full changelog:
 https://github.com/berrym/btrfs-backup-ng/blob/v0.9.13/CHANGELOG.md

 ----

 Update to 0.9.12

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected btrfs-backup-ng package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2026-344a8310cc

Plugin Details

Severity: High

ID: 374658

File Name: fedora_2026-344a8310cc.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/31/2026

Updated: 10/31/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:45, p-cpe:/a:fedoraproject:fedora:btrfs-backup-ng

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/22/2026

Vulnerability Publication Date: 10/22/2026

Reference Information