CVE-2022-49993
published 2025-06-18CVE-2022-49993: In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can configure a loop using an…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
11.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
loop: Check for overflow while configuring loop
The userspace can configure a loop using an ioctl call, wherein
a configuration of type loop_config is passed (see lo_ioctl()'s
case on line 1550 of drivers/block/loop.c). This proceeds to call
loop_configure() which in turn calls loop_set_status_from_info()
(see line 1050 of loop.c), passing &config->info which is of type
loop_info64*. This function then sets the appropriate values, like
the offset.
loop_device has lo_offset of type loff_t (see line 52 of loop.c),
which is typdef-chained to long long, whereas loop_info64 has
lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).
The function directly copies offset from info to the device as
follows (See line 980 of loop.c):
lo->lo_offset = info->lo_offset;
This results in an overflow, which triggers a warning in iomap_iter()
due to a call to iomap_iter_done() which has:
WARN_ON_ONCE(iter->iomap.offset > iter->pos);
Thus, check for negative value during loop_set_status_from_info().
Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 18e28817cb516b39de6281f6db9b0618b2cc7b42 | 18e28817cb516b39de6281f6db9b0618b2cc7b42 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < adf0112d9b8acb03485624220b4934f69bf13369 | adf0112d9b8acb03485624220b4934f69bf13369 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a217715338fd48f72114725aa7a40e484a781ca7 | a217715338fd48f72114725aa7a40e484a781ca7 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b40877b8562c5720d0a7fce20729f56b75a3dede | b40877b8562c5720d0a7fce20729f56b75a3dede |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6858933131d0dadac071c4d33335a9ea4b8e76cf | 6858933131d0dadac071c4d33335a9ea4b8e76cf |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0455bef69028c65065f16bb04635591b2374249b | 0455bef69028c65065f16bb04635591b2374249b |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9be7fa7ead18a48940df7b59d993bbc8b9055c15 | 9be7fa7ead18a48940df7b59d993bbc8b9055c15 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c490a0b5a4f36da3918181a8acdc6991d967c5f3 | c490a0b5a4f36da3918181a8acdc6991d967c5f3 |
| linux | linux_kernel | < 4.9.327 | 4.9.327 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 4.10 < 4.14.292 | 4.14.292 |
| linux | linux_kernel | >= 4.15 < 4.19.312 | 4.19.312 |
| linux | linux_kernel | >= 4.20 < 5.4.274 | 5.4.274 |
| linux | linux_kernel | >= 5.11 < 5.15.64 | 5.15.64 |
| linux | linux_kernel | >= 5.16 < 5.19.6 | 5.19.6 |
| linux | linux_kernel | >= 5.5 < 5.10.140 | 5.10.140 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-49993: In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can configure a loop
osv·2025-06-18·CVSS 5.5
CVE-2022-49993 [MEDIUM] CVE-2022-49993: In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can configure a loop
In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can configure a loop using an ioctl call, wherein a configuration of type loop_config is passed (see lo_ioctl()'s case on line 1550 of drivers/block/loop.c). This proceeds to call loop_configure() which in turn calls loop_set_status_from_info() (see line 1050 of loop.c), passing &config->info which is of type loop_info64*. This function then sets the appropriate values, like the offset. loop_device has lo_offset of type loff_t (see line 52 of loop.c), which is typdef-chained to long long, whereas loop_info64 has lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h). The function directly copies offset from info to the device as follows (See line 980
GHSA
GHSA-x3g2-qmp5-mx6f: In the Linux kernel, the following vulnerability has been resolved:
loop: Check for overflow while configuring loop
The userspace can configure a lo
ghsa_unreviewed·2025-06-18
CVE-2022-49993 [MEDIUM] GHSA-x3g2-qmp5-mx6f: In the Linux kernel, the following vulnerability has been resolved:
loop: Check for overflow while configuring loop
The userspace can configure a lo
In the Linux kernel, the following vulnerability has been resolved:
loop: Check for overflow while configuring loop
The userspace can configure a loop using an ioctl call, wherein
a configuration of type loop_config is passed (see lo_ioctl()'s
case on line 1550 of drivers/block/loop.c). This proceeds to call
loop_configure() which in turn calls loop_set_status_from_info()
(see line 1050 of loop.c), passing &config->info which is of type
loop_info64*. This function then sets the appropriate values, like
the offset.
loop_device has lo_offset of type loff_t (see line 52 of loop.c),
which is typdef-chained to long long, whereas loop_info64 has
lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).
The function directly copies offset from info to the device as
follows (See line
Red Hat
kernel: loop: Check for overflow while configuring loop
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-49993 [MEDIUM] CWE-681 kernel: loop: Check for overflow while configuring loop
kernel: loop: Check for overflow while configuring loop
In the Linux kernel, the following vulnerability has been resolved:
loop: Check for overflow while configuring loop
The userspace can configure a loop using an ioctl call, wherein
a configuration of type loop_config is passed (see lo_ioctl()'s
case on line 1550 of drivers/block/loop.c). This proceeds to call
loop_configure() which in turn calls loop_set_status_from_info()
(see line 1050 of loop.c), passing &config->info which is of type
loop_info64*. This function then sets the appropriate values, like
the offset.
loop_device has lo_offset of type loff_t (see line 52 of loop.c),
which is typdef-chained to long long, whereas loop_info64 has
lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).
The function directly copie
Debian
CVE-2022-49993: linux - In the Linux kernel, the following vulnerability has been resolved: loop: Check...
vendor_debian·2022·CVSS 5.5
CVE-2022-49993 [MEDIUM] CVE-2022-49993: linux - In the Linux kernel, the following vulnerability has been resolved: loop: Check...
In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can configure a loop using an ioctl call, wherein a configuration of type loop_config is passed (see lo_ioctl()'s case on line 1550 of drivers/block/loop.c). This proceeds to call loop_configure() which in turn calls loop_set_status_from_info() (see line 1050 of loop.c), passing &config->info which is of type loop_info64*. This function then sets the appropriate values, like the offset. loop_device has lo_offset of type loff_t (see line 52 of loop.c), which is typdef-chained to long long, whereas loop_info64 has lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h). The function directly copies offset from info to the device as follows (See line 980
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0455bef69028c65065f16bb04635591b2374249bhttps://git.kernel.org/stable/c/18e28817cb516b39de6281f6db9b0618b2cc7b42https://git.kernel.org/stable/c/6858933131d0dadac071c4d33335a9ea4b8e76cfhttps://git.kernel.org/stable/c/9be7fa7ead18a48940df7b59d993bbc8b9055c15https://git.kernel.org/stable/c/a217715338fd48f72114725aa7a40e484a781ca7https://git.kernel.org/stable/c/adf0112d9b8acb03485624220b4934f69bf13369https://git.kernel.org/stable/c/b40877b8562c5720d0a7fce20729f56b75a3dedehttps://git.kernel.org/stable/c/c490a0b5a4f36da3918181a8acdc6991d967c5f3
2025-06-18
Published