oss-security - Linux kernel: fs/btrfs: null-ptr-dereference bug in btrfs_rm

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFcO6XP=t-BCX=NP=B6qH5WVQ1jc=pOS24d0d=6MS2dm66A_mQ@mail.gmail.com>
Date: Wed, 25 Aug 2021 10:49:04 +0800
From: butt3rflyh4ck <butterflyhuangxx@...il.com>
To: oss-security@...ts.openwall.com
Subject: Linux kernel: fs/btrfs: null-ptr-dereference bug in
 btrfs_rm_device in fs/btrfs/volumes.c

Hello, there is a null pointer dereference bug in the btrfs_rm_device
function in fs/btrfs/volumes.c in linux-5.14.0-rc4+ and reproduce too.
Fortunately, triggering the bug requires ‘CAP_SYS_ADMIN’.

#Root Cause
When a user invokes a BTRFS_IOC_RM_DEV_V2 ioctl to remove a non-exist
volume device,
it would call btrfs_ioctl_rm_dev_v2 function to implement. And
btrfs_ioctl_rm_dev_v2 would call btrfs_rm_device,
if the id of the volume device is illegal, it would trigger a
null-ptr-deref bug to cause DoS.

# Analyse
https://lore.kernel.org/linux-btrfs/CAFcO6XO5TC5sEo-C9JGC75JkNAzkOSSLA3a=bwQqXFFbRTZ7Gw@mail.gmail.com/T/#md4b850f33616b7364f86e6fed144abc925f3669c

#Fix
the patch for this issue, not available upstream now.
https://lore.kernel.org/linux-btrfs/20210806102415.304717-1-wqu@suse.com/T/#u

#Timeline
*2021/8/6 - Vulnerability reported to maintainer and CC to
linux-btrfs@...r.kernel.org.
*2021/8/6 - Vulnerability confirmed and patched.
*2021/8/10 - Vulnerability reported to secalert@...hat.com.
*2021/8/25 - Opened on oss-security@...ts.openwall.com.

#Credit
the issue is reported by Active Defense Lab of Venustech.

Regards,
 butt3rflyh4ck.
-- 
Active Defense Lab of Venustech

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.