Critical Offset Calculation Vulnerability in Linux Kernel - CVE-2022-49747
Summary
CVE-2022-49747: In the Linux kernel, the following vulnerability has been resolved: erofs/zmap.c: Fix incorrect offset calculation Effective offset to add to length was being incorrectly calculated, which resulted in iomap->length being... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is widely used in various distributions, including Debian. This vulnerability specifically affects the EROFS (Enhanced Read-Only File System) component, which is designed for efficient storage and retrieval of files. The vulnerability arises from an incorrect offset calculation in the erofs/zmap.c file, potentially leading to system crashes and instability.
Vulnerability Detail
CVE-2022-49747 is a vulnerability in the Linux kernel that stems from an incorrect calculation of the effective offset to add to length in the EROFS file system. This miscalculation results in the iomap->length being set to 0, which triggers a WARN_ON in the iomap_iter_done() function. The issue was reported as a crash by syzbot, indicating that it could lead to system instability and unexpected behavior, particularly when handling file operations within the EROFS.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49747 is a critical vulnerability in the Linux kernel affecting the EROFS file system due to an incorrect offset calculation. Users are advised to update to the patched version 6.1.11-1 to ensure system stability and security. Monitoring tools like Vulert can help keep track of vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49747 is a vulnerability in the Linux kernel that affects the EROFS file system due to an incorrect offset calculation, potentially leading to system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to system crashes and instability, particularly during file operations in the EROFS file system.
Yes, a patch is available in the form of the Linux kernel version 6.1.11-1. Users should update their systems to this version to mitigate the vulnerability.
While there are no specific workarounds, it is recommended to monitor your system for any unusual behavior and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
