Gabriel Vlasiu reported that xfs_metadump, part of the xfsprogs suite of tools for the XFS filesystem, did not properly obfuscate data.
xfs_metadump properly obfuscates active metadata, but the rest of the space within that fs block comes through in the clear. This could lead to exposure of stale disk data via the produced metadump image.

The expectation of xfs_metadump is to obfuscate all but the shortest names in the metadata, as noted in the manpage :

By default, xfs_metadump obfuscates most file (regular file, directory and symbolic link) names and extended attribute names to allow the dumps to be sent without revealing confidential information. Extended attribute values are zeroed and no data is copied. The only exceptions are file or attribute names that are 4 or less characters in length.
Also file names that span extents (this can only occur with the mkfs.xfs(8) options where -n size > -b size) are not obfuscated. Names between 5 and 8 characters in length inclusively are partially obfuscated.

While the xfs_metadump tool can be run by unprivileged users, it requires appropriate permissions to access block devices (such as root) where the sensitive data might be dumped. An unprivileged user, without access to the block device, could not use this flaw to obtain sensitive data they would not otherwise have permission to access.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2151 advisory.

    - Fix xfs_metadump disclosure flaw, CVE-2012-2150  (#1251118)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has xfsprogs packages installed that are affected by a vulnerability:

  - xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file data, which allows remote attackers     to obtain sensitive information by reading a generated image. (CVE-2012-2150)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the xfs_metadump tool of the xfsprogs suite did not fully adhere to the standards of obfuscation described in its man page. In case a user with the necessary privileges used xfs_metadump and relied on the advertised obfuscation, the generated data could contain unexpected traces of potentially sensitive information.
(CVE-2012-2150)

The xfsprogs packages have been upgraded to upstream version 3.2.2, which provides a number of bug fixes and enhancements over the previous version. This release also includes updates present in upstream version 3.2.3, although it omits the mkfs.xfs default disk format change (for metadata checksumming) which is present upstream.

xfsprogs was updated to fix one security vulnerability and several bugs.

  - Handle unwanted data disclosure in xfs_metadump     (bsc#939367, CVE-2012-2150)

  - Fix segfault during xfs_repair run (bsc#911866)

  - Fix definition of leaf attribute block to avoid gcc     optimization xfsprogs-fix-leaf-block-definition

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xfsprogs was updated to fix one security vulnerability and several bugs.

  - Handle unwanted data disclosure in xfs_metadump     (bsc#939367, CVE-2012-2150)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xfsprogs was updated to fix one security vulnerability and bugs.

  - Handle unwanted data disclosure in xfs_metadump     (bsc#939367, CVE-2012-2150)

  - Fix definition of leaf attribute block to avoid gcc     optimization xfsprogs-fix-leaf-block-definition

ID	Name	Product	Family	Published	Updated	Severity
85358	Fedora 22 : xfsprogs-3.2.2-2.fc22 (2015-12435)	Nessus	Fedora Local Security Checks	8/13/2015	1/11/2021	medium
85548	Fedora 23 : xfsprogs-3.2.4-1.fc23 (2015-12380)	Nessus	Fedora Local Security Checks	8/20/2015	1/11/2021	medium
87025	Oracle Linux 7 : xfsprogs (ELSA-2015-2151)	Nessus	Oracle Linux Local Security Checks	11/24/2015	10/23/2024	high
266259	NewStart CGSL MAIN 6.06 : xfsprogs Vulnerability (NS-SA-2025-0223)	Nessus	NewStart CGSL Local Security Checks	9/30/2025	9/30/2025	high
87579	Scientific Linux Security Update : xfsprogs on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	12/22/2015	1/14/2021	medium
87666	SUSE SLED11 / SLES11 Security Update : xfsprogs (SUSE-SU-2015:2383-1)	Nessus	SuSE Local Security Checks	12/30/2015	1/6/2021	medium
87667	SUSE SLED12 / SLES12 Security Update : xfsprogs (SUSE-SU-2015:2384-1)	Nessus	SuSE Local Security Checks	12/30/2015	1/6/2021	medium
85610	openSUSE Security Update : xfsprogs (openSUSE-2015-555)	Nessus	SuSE Local Security Checks	8/25/2015	1/19/2021	medium

Detections

Analytics

Plugins Search

medium

medium

high

high

medium

medium

medium

medium