CVE-2022-49993

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

loop: Check for overflow while configuring loop

The userspace can configure a loop using an ioctl call, wherein

a configuration of type loop_config is passed (see lo_ioctl()'s

case on line 1550 of drivers/block/loop.c). This proceeds to call

loop_configure() which in turn calls loop_set_status_from_info()

(see line 1050 of loop.c), passing &config->info which is of type

loop_info64*. This function then sets the appropriate values, like

the offset.

loop_device has lo_offset of type loff_t (see line 52 of loop.c),

which is typdef-chained to long long, whereas loop_info64 has

lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).

The function directly copies offset from info to the device as

follows (See line 980 of loop.c):

lo->lo_offset = info->lo_offset;

This results in an overflow, which triggers a warning in iomap_iter()

due to a call to iomap_iter_done() which has:

WARN_ON_ONCE(iter->iomap.offset

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References