7 min read
Linux kernel btrfs slab out-of-bounds write
Mounting a crafted btrfs image and running operations triggers a slab out-of-bounds write in __btrfs_map_block.
Read full articleTags
btrfs
7 min read
Linux kernel btrfs use-after-free
A syncfs syscall after operations on a crafted btrfs image triggers a use-after-free reached via mutex_can_spin_on_owner.
Read full article7 min read
Linux kernel btrfs use-after-free
A syncfs syscall after operations on a crafted btrfs image triggers a use-after-free in try_merge_free_space.
Read full article3 min read
Linux kernel btrfs slab out-of-bounds write
Mounting a crafted btrfs filesystem image leads to a slab-out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c.
Read full article3 min read
Linux kernel btrfs use-after-free
Mounting a crafted btrfs image, performing some operations, and unmounting leads to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.
Read full article3 min read
Linux kernel btrfs use-after-free
Mounting a crafted btrfs image twice causes an rwsem_down_write_slowpath use-after-free because rwsem_owner_flags returns an already freed task_struct pointer.
Read full article3 min read
Linux kernel btrfs information disclosure
__btrfs_free_extent in fs/btrfs/extent-tree.c calls btrfs_print_leaf in a certain ENOENT case, leaking potentially sensitive register values to local users through dmesg.
Read full article3 min read
Linux kernel btrfs root node NULL pointer dereference
btrfs_root_node in fs/btrfs/ctree.c allows a NULL pointer dereference because rcu_dereference(root->node) can return zero when a crafted btrfs image is mounted.
Read full article3 min read
Linux kernel btrfs NULL pointer dereference
A crafted btrfs image triggers a NULL pointer dereference in btrfs_verify_dev_extents because fs_devices->devices is mishandled inside find_device (fs/btrfs/volumes.c) in Linux kernels before 5.1.
Read full article