CVE-2022-49747 (GCVE-0-2022-49747)

Vulnerability from cvelistv5 – Published: 2025-03-27 16:42 – Updated: 2026-05-11 19:05
VLAI
Title
erofs/zmap.c: Fix incorrect offset calculation
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs/zmap.c: Fix incorrect offset calculation Effective offset to add to length was being incorrectly calculated, which resulted in iomap->length being set to 0, triggering a WARN_ON in iomap_iter_done(). Fix that, and describe it in comments. This was reported as a crash by syzbot under an issue about a warning encountered in iomap_iter_done(), but unrelated to erofs. C reproducer: https://syzkaller.appspot.com/text?tag=ReproC&x=1037a6b2880000 Kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=e2021a61197ebe02 Dashboard link: https://syzkaller.appspot.com/bug?extid=a8e049cd3abd342936b6
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eadcd6b5a1eb39866ab8d8a3e4f2e51bc51a2350 , < 2144859229c1e74f52d3ea067338d314a83a8afb (git)
Affected: eadcd6b5a1eb39866ab8d8a3e4f2e51bc51a2350 , < 9f31d8c889d9a4e47bfcc6c4537d0c9f89fe582c (git)
Affected: eadcd6b5a1eb39866ab8d8a3e4f2e51bc51a2350 , < 6acd87d50998ef0afafc441613aeaf5a8f5c9eff (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.92 , ≤ 5.15.* (semver)
Unaffected: 6.1.10 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2144859229c1e74f52d3ea067338d314a83a8afb",
              "status": "affected",
              "version": "eadcd6b5a1eb39866ab8d8a3e4f2e51bc51a2350",
              "versionType": "git"
            },
            {
              "lessThan": "9f31d8c889d9a4e47bfcc6c4537d0c9f89fe582c",
              "status": "affected",
              "version": "eadcd6b5a1eb39866ab8d8a3e4f2e51bc51a2350",
              "versionType": "git"
            },
            {
              "lessThan": "6acd87d50998ef0afafc441613aeaf5a8f5c9eff",
              "status": "affected",
              "version": "eadcd6b5a1eb39866ab8d8a3e4f2e51bc51a2350",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.92",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs/zmap.c: Fix incorrect offset calculation\n\nEffective offset to add to length was being incorrectly calculated,\nwhich resulted in iomap-\u003elength being set to 0, triggering a WARN_ON\nin iomap_iter_done().\n\nFix that, and describe it in comments.\n\nThis was reported as a crash by syzbot under an issue about a warning\nencountered in iomap_iter_done(), but unrelated to erofs.\n\nC reproducer: https://syzkaller.appspot.com/text?tag=ReproC\u0026x=1037a6b2880000\nKernel config: https://syzkaller.appspot.com/text?tag=KernelConfig\u0026x=e2021a61197ebe02\nDashboard link: https://syzkaller.appspot.com/bug?extid=a8e049cd3abd342936b6"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:05:58.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2144859229c1e74f52d3ea067338d314a83a8afb"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f31d8c889d9a4e47bfcc6c4537d0c9f89fe582c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6acd87d50998ef0afafc441613aeaf5a8f5c9eff"
        }
      ],
      "title": "erofs/zmap.c: Fix incorrect offset calculation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49747",
    "datePublished": "2025-03-27T16:42:57.094Z",
    "dateReserved": "2025-03-27T16:39:17.987Z",
    "dateUpdated": "2026-05-11T19:05:58.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49747",
      "date": "2026-10-01",
      "epss": "0.00188",
      "percentile": "0.07576"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/erofs/zmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2144859229c1e74f52d3ea067338d314a83a8afb",
                    "status": "affected",
                    "version": "eadcd6b5a1eb39866ab8d8a3e4f2e51bc51a2350",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f31d8c889d9a4e47bfcc6c4537d0c9f89fe582c",
                    "status": "affected",
                    "version": "eadcd6b5a1eb39866ab8d8a3e4f2e51bc51a2350",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6acd87d50998ef0afafc441613aeaf5a8f5c9eff",
                    "status": "affected",
                    "version": "eadcd6b5a1eb39866ab8d8a3e4f2e51bc51a2350",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/erofs/zmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.92",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC24FFD4-3B7F-4D3F-B022-9C6314AEB133",
                    "versionEndExcluding": "5.15.92",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "482D2612-A4D4-4A68-AC23-52F6BE89878B",
                    "versionEndExcluding": "6.1.10",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A127C155-689C-4F67-B146-44A57F4BFD85",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs/zmap.c: Fix incorrect offset calculation\n\nEffective offset to add to length was being incorrectly calculated,\nwhich resulted in iomap-\u003elength being set to 0, triggering a WARN_ON\nin iomap_iter_done().\n\nFix that, and describe it in comments.\n\nThis was reported as a crash by syzbot under an issue about a warning\nencountered in iomap_iter_done(), but unrelated to erofs.\n\nC reproducer: https://syzkaller.appspot.com/text?tag=ReproC\u0026x=1037a6b2880000\nKernel config: https://syzkaller.appspot.com/text?tag=KernelConfig\u0026x=e2021a61197ebe02\nDashboard link: https://syzkaller.appspot.com/bug?extid=a8e049cd3abd342936b6"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: erofs/zmap.c: Se corrigi\u00f3 el c\u00e1lculo incorrecto del desplazamiento. El desplazamiento efectivo para a\u00f1adir a length se calculaba incorrectamente, lo que provocaba que iomap-\u0026gt;length se estableciera en 0, lo que activaba un WARN_ON en iomap_iter_done(). Se corrigi\u00f3 y se describi\u00f3 en los comentarios. syzbot report\u00f3 esto como un fallo en un problema relacionado con una advertencia encontrada en iomap_iter_done(), pero no relacionada con erofs. Reproductor C: https://syzkaller.appspot.com/text?tag=ReproC\u0026amp;x=1037a6b2880000 Configuraci\u00f3n del kernel: https://syzkaller.appspot.com/text?tag=KernelConfig\u0026amp;x=e2021a61197ebe02 Enlace del panel: https://syzkaller.appspot.com/bug?extid=a8e049cd3abd342936b6"
          }
        ],
        "id": "CVE-2022-49747",
        "lastModified": "2026-06-17T05:19:02.093",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-03-27T17:15:39.477",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2144859229c1e74f52d3ea067338d314a83a8afb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6acd87d50998ef0afafc441613aeaf5a8f5c9eff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9f31d8c889d9a4e47bfcc6c4537d0c9f89fe582c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:16:46+00:00",
      "cve": "CVE-2022-49747",
      "id": "CVE-2022-49747",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: erofs/zmap.c: Fix incorrect offset calculation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49747.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:29:26Z",
      "cve": "CVE-2022-49747",
      "id": "CVE-2022-49747",
      "initial_release_date": "2025-03-28T03:40:55Z",
      "product_status:known_not_affected": "459",
      "product_status:recommended": "43",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49747",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49747.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.