fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfsverifydevextents NULL pointer dereference via a crafted btrfs image because fsdevices->devices is mishandled within find_device, aka CID-09ba3bc9dd15.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-18885.json"
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 291.0,
"function_hash": "264032400187847081624658273111784749565"
},
"id": "CVE-2019-18885-140f9e28",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "find_device"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 3468.0,
"function_hash": "9386389311953225676024101247146405890"
},
"id": "CVE-2019-18885-1b504e32",
"target": {
"file": "fs/btrfs/scrub.c",
"function": "btrfs_scrub_dev"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 3813.0,
"function_hash": "240696963628129566008226651951636394351"
},
"id": "CVE-2019-18885-1c1efb28",
"target": {
"file": "fs/btrfs/dev-replace.c",
"function": "btrfs_init_dev_replace"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 967.0,
"function_hash": "42746897538597958790141610745253232010"
},
"id": "CVE-2019-18885-1f87e28a",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "btrfs_get_dev_stats"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"137489301220492131433634887572394915706",
"293172553910745156778014302058819826536",
"72146900628452723644256790468828614272",
"330983953245714466137029105446617043861",
"237801351120179928433609474790193127036",
"99408072577012354846360037453744918004",
"312339869278159899073864173905976787840"
]
},
"id": "CVE-2019-18885-236348f6",
"target": {
"file": "fs/btrfs/dev-replace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1407.0,
"function_hash": "180417412862395275144206025609157869439"
},
"id": "CVE-2019-18885-255a92ce",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "btrfs_finish_sprout"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2012.0,
"function_hash": "60979109241469565904691504877415932956"
},
"id": "CVE-2019-18885-35ca1ed3",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "verify_one_dev_extent"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2149.0,
"function_hash": "245264374549254772564003138606649492254"
},
"id": "CVE-2019-18885-52c0a6cd",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "read_one_dev"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2601.0,
"function_hash": "138253254208684392320779345348967369493"
},
"id": "CVE-2019-18885-596dd431",
"target": {
"file": "fs/btrfs/ioctl.c",
"function": "btrfs_ioctl_resize"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"292731343906455290268543941507398576969",
"93733012912885169949694402384982727186",
"120505155149859243687739919008075234538",
"38220573424718975942914052595871171247",
"213951886543898412003253408061693172109",
"48049436301957117565773456266931840854",
"312419303645968568047404149386410940249",
"62469523431846059742348402009411058355",
"269676272171219324282501224207584954414",
"176819773131983646772274928989731805505",
"30670121383038562587045027279046691704",
"220884027888050459794073188008898298494",
"318639709572213250168945998247045762420",
"128950854498050037566328494275306111379",
"11925617802993325878917055281383287731",
"273860038305507700156720814708209308374",
"268929047939654305712689820673691509018",
"204028882212514693778252449519703848575",
"63140688634272292097901954968314296738",
"183992772129446847415463367451800168663",
"93793519945227279235549067405087768209",
"69001047244493175029084354787915294924",
"28316222167281658764044968694985577848",
"59912355137507934638722760665076802156",
"208610468512863452651611727858800011411",
"28355348460553087709799439248050530000",
"48336699924237768261511440487107763214",
"91857297701270853432017418435525981849",
"126152367155848341439292326023798088509",
"88864503700982184485125906487824524098",
"8602694943324169612301631399525993862",
"258504920266505510278033682070784743533",
"195551704738700031428118050075731124803",
"125162234299036280993301519832649748211",
"161297472982836254970614452096518632193",
"204314342668118372289167954344382186259",
"239736885187897204662268041632672735228",
"202149978775317894800503468681622122549",
"85097852861292118655532812103371684438",
"312903818719314784269088882772644101487",
"215924226553683794554380339406205582577",
"149290206768152606286302639445768178249",
"228551175759081841945686521670789705254",
"296844463690323549035946498313055879512",
"313556100927538081172070113583515672373",
"3950912067119406385679731992447745607",
"9992290615859136941804637345727710458",
"151029928757383356404706281580175019373",
"227231892492477361581028393666869519918",
"234342232642682636847892318233783231638",
"206755061034217520203636891018167989127",
"211158833443322285814982579803215551150",
"4619793125976760778381265110214369342",
"168418830320726511209821253423695845149",
"128408512217286667909924548010530184231",
"172216440885294482617871886090408957527",
"300319774423947491955396924852323457201",
"231149127604208314557667609786007249427",
"219353442966510270700680472402151331042",
"254203726232144340735579691794136934552",
"93336218171323574097075916727833689725",
"133984163679427238050913236538652353393",
"91383669815698807578526846898855594521",
"335314208205917856983080222110455160838",
"76657318462459198425374100923021541878",
"91268019303041493768191204052646197918",
"253870049021679738089969117371646888940",
"68295521007728745090997512646332088119",
"184626333795119838787671273717360169653",
"94354138363279118159342018093005205805"
]
},
"id": "CVE-2019-18885-6a6cfa96",
"target": {
"file": "fs/btrfs/volumes.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 902.0,
"function_hash": "144877838286509070918948951937729449300"
},
"id": "CVE-2019-18885-6cc6e913",
"target": {
"file": "fs/btrfs/ioctl.c",
"function": "btrfs_ioctl_dev_info"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 686.0,
"function_hash": "177098226452853602063037121100382539787"
},
"id": "CVE-2019-18885-709b7559",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "btrfs_find_device_by_path"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2576.0,
"function_hash": "102994316532424579008864311222200886296"
},
"id": "CVE-2019-18885-787363db",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "read_one_chunk"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"30420138054642622626458328965258240500",
"145956217806981491461460106746363895142",
"317134474831063933703147615405440719369",
"37466983485931252366940398439323051372",
"227811644838282816086732054055595275223",
"250300588152743354703861192858095111353",
"2130564915753061090666281430625496910",
"138050862332935473335575770027183238821"
]
},
"id": "CVE-2019-18885-961a9621",
"target": {
"file": "fs/btrfs/ioctl.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"60397627012785770095882679949449293371",
"130190846726895091137775642375088408111",
"248008021656600866912028100956519565646",
"123199971178282728109355590281902956512",
"190774735072326181495737150742746659687",
"45644842502729667810479624667513173913",
"36942118465806840506858739348298103951",
"56120139674298060460037308583584163997"
]
},
"id": "CVE-2019-18885-9fe547a7",
"target": {
"file": "fs/btrfs/scrub.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"257905882668748992707901597870314772745",
"177498928716916210567365439562985570734",
"291963030854691513922705089159463096066",
"133638106521177849524637376211393546866"
]
},
"id": "CVE-2019-18885-a4769da0",
"target": {
"file": "fs/btrfs/volumes.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 582.0,
"function_hash": "308713621463116483090128010714254211766"
},
"id": "CVE-2019-18885-ddf948bb",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "btrfs_find_device_by_devspec"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 3446.0,
"function_hash": "220636003292283841876564817170130852970"
},
"id": "CVE-2019-18885-e1bc51cd",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "device_list_add"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 309.0,
"function_hash": "45595836850618425638853556972985525307"
},
"id": "CVE-2019-18885-e43ec830",
"target": {
"file": "fs/btrfs/volumes.c",
"function": "btrfs_find_device"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 436.0,
"function_hash": "235268738874882053536100716564305958155"
},
"id": "CVE-2019-18885-e9d575d3",
"target": {
"file": "fs/btrfs/scrub.c",
"function": "btrfs_scrub_progress"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@09ba3bc9dd150457c506e4661380a6183af651c1"
}
]