Description
xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xfsdump | 2.2.45-1 | — |
| Debian 13 | xfsdump | 2.2.45-1 | — |
| Debian 12 | xfsdump | 2.2.45-1 | — |
References
- 25761 third-party-advisory
- 23922 vdb-entry
- 36716 vdb-entry
- 26867 third-party-advisory
- USN-516-1 vendor-advisory
- 25425 third-party-advisory
- SUSE-SR:2007:010 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=417894
- 25220 third-party-advisory
- MDKSA-2007:134 vendor-advisory