CVE-2022-49464 (GCVE-0-2022-49464)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-08-05 08:55
VLAI
Title
erofs: fix buffer copy overflow of ztailpacking feature
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: fix buffer copy overflow of ztailpacking feature I got some KASAN report as below: [ 46.959738] ================================================================== [ 46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188 ... [ 46.960430] Call Trace: [ 46.960430] <TASK> [ 46.960430] dump_stack_lvl+0x41/0x5e [ 46.960430] print_report.cold+0xb2/0x6b7 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_report+0x8a/0x140 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_check_range+0x14d/0x1d0 [ 46.960430] memcpy+0x20/0x60 [ 46.960430] z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] z_erofs_decompress_pcluster+0xaae/0x1080 The root cause is that the tail pcluster won't be a complete filesystem block anymore. So if ztailpacking is used, the second part of an uncompressed tail pcluster may not be ``rq->pageofs_out``.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:16 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ab749badf9f41f32509cd103391b81ea7e684b76 , < 4d53a625f29074e7b8236c2c0e0922edb7608df9 (git)
Affected: ab749badf9f41f32509cd103391b81ea7e684b76 , < 6b59e1907f58cf877c563dcf013159eb9f994b64 (git)
Affected: ab749badf9f41f32509cd103391b81ea7e684b76 , < dcbe6803fffd387f72b48c2373b5f5ed12a5804b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49464",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:16:06.988946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:32.836Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4d53a625f29074e7b8236c2c0e0922edb7608df9",
              "status": "affected",
              "version": "ab749badf9f41f32509cd103391b81ea7e684b76",
              "versionType": "git"
            },
            {
              "lessThan": "6b59e1907f58cf877c563dcf013159eb9f994b64",
              "status": "affected",
              "version": "ab749badf9f41f32509cd103391b81ea7e684b76",
              "versionType": "git"
            },
            {
              "lessThan": "dcbe6803fffd387f72b48c2373b5f5ed12a5804b",
              "status": "affected",
              "version": "ab749badf9f41f32509cd103391b81ea7e684b76",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix buffer copy overflow of ztailpacking feature\n\nI got some KASAN report as below:\n\n[   46.959738] ==================================================================\n[   46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370\n[   46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188\n...\n[   46.960430] Call Trace:\n[   46.960430]  \u003cTASK\u003e\n[   46.960430]  dump_stack_lvl+0x41/0x5e\n[   46.960430]  print_report.cold+0xb2/0x6b7\n[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370\n[   46.960430]  kasan_report+0x8a/0x140\n[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370\n[   46.960430]  kasan_check_range+0x14d/0x1d0\n[   46.960430]  memcpy+0x20/0x60\n[   46.960430]  z_erofs_shifted_transform+0x2bd/0x370\n[   46.960430]  z_erofs_decompress_pcluster+0xaae/0x1080\n\nThe root cause is that the tail pcluster won\u0027t be a complete filesystem\nblock anymore. So if ztailpacking is used, the second part of an\nuncompressed tail pcluster may not be ``rq-\u003epageofs_out``."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the local EROFS compressed read path (read/mmap/readahead \u2192 z_erofs_decompress_pcluster \u2192 z_erofs_shifted_transform) after a local block/file-backed mount; erofs has FS_REQUIRES_DEV and no network-protocol entry into the decompressor.\nAC:L - An image with ztailpacking and an uncompressed (SHIFTED) tail pcluster that is not a full filesystem block but spans two pages deterministically uses pageofs_out instead of lefthalf, so the oversized memcpy/memmove fires on ordinary reads with no race or attacker-uncontrollable condition.\nPR:L - Mounting erofs is not userns-capable, but on the worst-case deployment (already-mounted Android/embedded system images, or automounted/composefs/APEX images) any unprivileged local user with read access triggers decompression with no further capability check.\nUI:N - On typical EROFS deployments the filesystem is already mounted, and the attacker triggers the overflow entirely with their own reads; automounters and container/APEX image runtimes similarly mount attacker-supplied images without a separate interactive victim step.\nS:U - The OOB/UAF copy and resulting kernel memory corruption stay within the host kernel\u0027s security authority; no VM escape, IOMMU bypass, or other cross-boundary impact occurs.\nC:H - KASAN reports a use-after-free/out-of-bounds read of thousands of bytes that memcpy copies from adjacent/freed kernel memory into the file\u0027s page cache, which userspace can then read\u2014an arbitrary kernel-memory disclosure per OOB-read/UAF guidance.\nI:H - The same overflow is a buffer copy overflow (oversized memcpy into the output page and memmove that can write past the inline source page when pageofs_in+pageofs_out exceeds PAGE_SIZE), and UAF/OOB write class corruption enables control-flow hijacking per kernel guidance.\nA:H - The demonstrated KASAN use-after-free/out-of-bounds access can oops or panic the kernel even when not fully exploited, which is Availability High under kernel CVSS guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:16.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4d53a625f29074e7b8236c2c0e0922edb7608df9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b59e1907f58cf877c563dcf013159eb9f994b64"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcbe6803fffd387f72b48c2373b5f5ed12a5804b"
        }
      ],
      "title": "erofs: fix buffer copy overflow of ztailpacking feature",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49464",
    "datePublished": "2025-02-26T02:13:10.321Z",
    "dateReserved": "2025-02-26T02:08:31.577Z",
    "dateUpdated": "2026-08-05T08:55:16.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49464",
      "date": "2026-08-30",
      "epss": "0.00259",
      "percentile": "0.17376"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49464\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:22.697\",\"lastModified\":\"2026-06-17T05:18:07.613\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nerofs: fix buffer copy overflow of ztailpacking feature\\n\\nI got some KASAN report as below:\\n\\n[   46.959738] ==================================================================\\n[   46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370\\n[   46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188\\n...\\n[   46.960430] Call Trace:\\n[   46.960430]  \u003cTASK\u003e\\n[   46.960430]  dump_stack_lvl+0x41/0x5e\\n[   46.960430]  print_report.cold+0xb2/0x6b7\\n[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370\\n[   46.960430]  kasan_report+0x8a/0x140\\n[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370\\n[   46.960430]  kasan_check_range+0x14d/0x1d0\\n[   46.960430]  memcpy+0x20/0x60\\n[   46.960430]  z_erofs_shifted_transform+0x2bd/0x370\\n[   46.960430]  z_erofs_decompress_pcluster+0xaae/0x1080\\n\\nThe root cause is that the tail pcluster won\u0027t be a complete filesystem\\nblock anymore. So if ztailpacking is used, the second part of an\\nuncompressed tail pcluster may not be ``rq-\u003epageofs_out``.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: erofs: arregla el desbordamiento de copia de b\u00fafer de la funci\u00f3n ztailpacking Recib\u00ed un informe de KASAN como el siguiente: [ 46.959738] ======================================================================== [ 46.960430] ERROR: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188 ... [ 46.960430] Call Trace: [ 46.960430]  [ 46.960430] dump_stack_lvl+0x41/0x5e [ 46.960430] print_report.cold+0xb2/0x6b7 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_report+0x8a/0x140 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_check_range+0x14d/0x1d0 [ 46.960430] memcpy+0x20/0x60 [ 46.960430] z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] z_erofs_decompress_pcluster+0xaae/0x1080 La causa ra\u00edz es que el pcluster de cola ya no ser\u00e1 un bloque de sistema de archivos completo. Por lo tanto, si se utiliza ztailpacking, la segunda parte de un pcluster de cola sin comprimir puede no ser ``rq-\u0026gt;pageofs_out``.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/erofs/decompressor.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ab749badf9f41f32509cd103391b81ea7e684b76\",\"lessThan\":\"4d53a625f29074e7b8236c2c0e0922edb7608df9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab749badf9f41f32509cd103391b81ea7e684b76\",\"lessThan\":\"6b59e1907f58cf877c563dcf013159eb9f994b64\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab749badf9f41f32509cd103391b81ea7e684b76\",\"lessThan\":\"dcbe6803fffd387f72b48c2373b5f5ed12a5804b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/erofs/decompressor.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.14\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.3\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:16:06.988946Z\",\"id\":\"CVE-2022-49464\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"C48ED8B1-C02B-4764-9298-070E29EF1F88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4d53a625f29074e7b8236c2c0e0922edb7608df9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b59e1907f58cf877c563dcf013159eb9f994b64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dcbe6803fffd387f72b48c2373b5f5ed12a5804b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-29T20:18:23+00:00",
      "cve": "CVE-2022-49464",
      "id": "CVE-2022-49464",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: erofs: fix buffer copy overflow of ztailpacking feature",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49464.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-26T16:50:15Z",
      "cve": "CVE-2022-49464",
      "id": "CVE-2022-49464",
      "initial_release_date": "2025-02-27T03:06:27Z",
      "product_status:known_not_affected": "352",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49464",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49464.json",
      "version": "14"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49464\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:16:06.988946Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:16:08.292Z\"}}], \"cna\": {\"title\": \"erofs: fix buffer copy overflow of ztailpacking feature\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only via the local EROFS compressed read path (read/mmap/readahead \\u2192 z_erofs_decompress_pcluster \\u2192 z_erofs_shifted_transform) after a local block/file-backed mount; erofs has FS_REQUIRES_DEV and no network-protocol entry into the decompressor.\\nAC:L - An image with ztailpacking and an uncompressed (SHIFTED) tail pcluster that is not a full filesystem block but spans two pages deterministically uses pageofs_out instead of lefthalf, so the oversized memcpy/memmove fires on ordinary reads with no race or attacker-uncontrollable condition.\\nPR:L - Mounting erofs is not userns-capable, but on the worst-case deployment (already-mounted Android/embedded system images, or automounted/composefs/APEX images) any unprivileged local user with read access triggers decompression with no further capability check.\\nUI:N - On typical EROFS deployments the filesystem is already mounted, and the attacker triggers the overflow entirely with their own reads; automounters and container/APEX image runtimes similarly mount attacker-supplied images without a separate interactive victim step.\\nS:U - The OOB/UAF copy and resulting kernel memory corruption stay within the host kernel\u0027s security authority; no VM escape, IOMMU bypass, or other cross-boundary impact occurs.\\nC:H - KASAN reports a use-after-free/out-of-bounds read of thousands of bytes that memcpy copies from adjacent/freed kernel memory into the file\u0027s page cache, which userspace can then read\\u2014an arbitrary kernel-memory disclosure per OOB-read/UAF guidance.\\nI:H - The same overflow is a buffer copy overflow (oversized memcpy into the output page and memmove that can write past the inline source page when pageofs_in+pageofs_out exceeds PAGE_SIZE), and UAF/OOB write class corruption enables control-flow hijacking per kernel guidance.\\nA:H - The demonstrated KASAN use-after-free/out-of-bounds access can oops or panic the kernel even when not fully exploited, which is Availability High under kernel CVSS guidance.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ab749badf9f41f32509cd103391b81ea7e684b76\", \"lessThan\": \"4d53a625f29074e7b8236c2c0e0922edb7608df9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ab749badf9f41f32509cd103391b81ea7e684b76\", \"lessThan\": \"6b59e1907f58cf877c563dcf013159eb9f994b64\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ab749badf9f41f32509cd103391b81ea7e684b76\", \"lessThan\": \"dcbe6803fffd387f72b48c2373b5f5ed12a5804b\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/erofs/decompressor.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.17.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/erofs/decompressor.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4d53a625f29074e7b8236c2c0e0922edb7608df9\"}, {\"url\": \"https://git.kernel.org/stable/c/6b59e1907f58cf877c563dcf013159eb9f994b64\"}, {\"url\": \"https://git.kernel.org/stable/c/dcbe6803fffd387f72b48c2373b5f5ed12a5804b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nerofs: fix buffer copy overflow of ztailpacking feature\\n\\nI got some KASAN report as below:\\n\\n[   46.959738] ==================================================================\\n[   46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370\\n[   46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188\\n...\\n[   46.960430] Call Trace:\\n[   46.960430]  \u003cTASK\u003e\\n[   46.960430]  dump_stack_lvl+0x41/0x5e\\n[   46.960430]  print_report.cold+0xb2/0x6b7\\n[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370\\n[   46.960430]  kasan_report+0x8a/0x140\\n[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370\\n[   46.960430]  kasan_check_range+0x14d/0x1d0\\n[   46.960430]  memcpy+0x20/0x60\\n[   46.960430]  z_erofs_shifted_transform+0x2bd/0x370\\n[   46.960430]  z_erofs_decompress_pcluster+0xaae/0x1080\\n\\nThe root cause is that the tail pcluster won\u0027t be a complete filesystem\\nblock anymore. So if ztailpacking is used, the second part of an\\nuncompressed tail pcluster may not be ``rq-\u003epageofs_out``.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.14\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.3\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"5.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:55:16.048Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49464\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:55:16.048Z\", \"dateReserved\": \"2025-02-26T02:08:31.577Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:13:10.321Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.