CVE-2022-49993
loop: Check for overflow while configuring loop
Description
In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can configure a loop using an ioctl call, wherein a configuration of type loop_config is passed (see lo_ioctl()'s case on line 1550 of drivers/block/loop.c). This proceeds to call loop_configure() which in turn calls loop_set_status_from_info() (see line 1050 of loop.c), passing &config->info which is of type loop_info64*. This function then sets the appropriate values, like the offset. loop_device has lo_offset of type loff_t (see line 52 of loop.c), which is typdef-chained to long long, whereas loop_info64 has lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h). The function directly copies offset from info to the device as follows (See line 980 of loop.c): lo->lo_offset = info->lo_offset; This results in an overflow, which triggers a warning in iomap_iter() due to a call to iomap_iter_done() which has: WARN_ON_ONCE(iter->iomap.offset > iter->pos); Thus, check for negative value during loop_set_status_from_info(). Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e
INFO
Published Date :
June 18, 2025, 11:15 a.m.
Last Modified :
Nov. 14, 2025, 6:12 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to a patched version.
- Verify the patch addresses the offset overflow vulnerability.
- Test loop device functionality after the update.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2022-49993.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2022-49993 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2022-49993
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-49993 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2022-49993 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 14, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10 up to (excluding) 4.14.292 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.140 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.64 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 5.19.6 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.9.327 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 4.19.312 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.274 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0455bef69028c65065f16bb04635591b2374249b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/18e28817cb516b39de6281f6db9b0618b2cc7b42 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6858933131d0dadac071c4d33335a9ea4b8e76cf Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9be7fa7ead18a48940df7b59d993bbc8b9055c15 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a217715338fd48f72114725aa7a40e484a781ca7 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/adf0112d9b8acb03485624220b4934f69bf13369 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b40877b8562c5720d0a7fce20729f56b75a3dede Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c490a0b5a4f36da3918181a8acdc6991d967c5f3 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 18, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can configure a loop using an ioctl call, wherein a configuration of type loop_config is passed (see lo_ioctl()'s case on line 1550 of drivers/block/loop.c). This proceeds to call loop_configure() which in turn calls loop_set_status_from_info() (see line 1050 of loop.c), passing &config->info which is of type loop_info64*. This function then sets the appropriate values, like the offset. loop_device has lo_offset of type loff_t (see line 52 of loop.c), which is typdef-chained to long long, whereas loop_info64 has lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h). The function directly copies offset from info to the device as follows (See line 980 of loop.c): lo->lo_offset = info->lo_offset; This results in an overflow, which triggers a warning in iomap_iter() due to a call to iomap_iter_done() which has: WARN_ON_ONCE(iter->iomap.offset > iter->pos); Thus, check for negative value during loop_set_status_from_info(). Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e Added Reference https://git.kernel.org/stable/c/0455bef69028c65065f16bb04635591b2374249b Added Reference https://git.kernel.org/stable/c/18e28817cb516b39de6281f6db9b0618b2cc7b42 Added Reference https://git.kernel.org/stable/c/6858933131d0dadac071c4d33335a9ea4b8e76cf Added Reference https://git.kernel.org/stable/c/9be7fa7ead18a48940df7b59d993bbc8b9055c15 Added Reference https://git.kernel.org/stable/c/a217715338fd48f72114725aa7a40e484a781ca7 Added Reference https://git.kernel.org/stable/c/adf0112d9b8acb03485624220b4934f69bf13369 Added Reference https://git.kernel.org/stable/c/b40877b8562c5720d0a7fce20729f56b75a3dede Added Reference https://git.kernel.org/stable/c/c490a0b5a4f36da3918181a8acdc6991d967c5f3