Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 26 Aug 2021 17:36:02 +0800
From: butt3rflyh4ck <>
Subject: Re: Linux kernel: fs/btrfs: null-ptr-dereference bug
 in btrfs_rm_device in fs/btrfs/volumes.c

Hi, RedHat has assigned  CVE-2021-3739   to this issue.

Please track the below link for more information.


On Wed, Aug 25, 2021 at 10:49 AM butt3rflyh4ck
<> wrote:
> Hello, there is a null pointer dereference bug in the btrfs_rm_device
> function in fs/btrfs/volumes.c in linux-5.14.0-rc4+ and reproduce too.
> Fortunately, triggering the bug requires ‘CAP_SYS_ADMIN’.
> #Root Cause
> When a user invokes a BTRFS_IOC_RM_DEV_V2 ioctl to remove a non-exist
> volume device,
> it would call btrfs_ioctl_rm_dev_v2 function to implement. And
> btrfs_ioctl_rm_dev_v2 would call btrfs_rm_device,
> if the id of the volume device is illegal, it would trigger a
> null-ptr-deref bug to cause DoS.
> # Analyse
> #Fix
> the patch for this issue, not available upstream now.
> #Timeline
> *2021/8/6 - Vulnerability reported to maintainer and CC to
> *2021/8/6 - Vulnerability confirmed and patched.
> *2021/8/10 - Vulnerability reported to
> *2021/8/25 - Opened on
> #Credit
> the issue is reported by Active Defense Lab of Venustech.
> Regards,
>  butt3rflyh4ck.
> --
> Active Defense Lab of Venustech

Active Defense Lab of Venustech

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.