Executive brief
EROFS is a compressed filesystem format used in Linux. A malformed filesystem image can trigger a use-after-free memory error when the kernel processes uncompressed data blocks with invalid extent lengths, potentially leading to a system crash or arbitrary code execution.
Technical details
The vulnerability exists in the Linux kernel's EROFS filesystem driver (fs/erofs/zmap.c) in the z_erofs_do_map_blocks function. The code fails to validate that the logical extent length (m_llen) does not exceed the physical extent length (m_plen) for uncompressed pcluster entries. A crafted EROFS filesystem image can provide mismatched lengths, triggering a KASAN use-after-free error. The attack requires mounting a malicious filesystem image locally; no network access is needed. The fix adds a simple bounds check that returns -EFSCORRUPTED if m_llen > m_plen, preventing the invalid memory access.
Affected products
- Linux Linux kernel Multiple versions (patched upstream commit c505feba4c0d76084e56ec498ce819f02a7043ae, stable backport 40c73b2ea9611b5388807be406f30f5e4e1162da)
Timeline
- 2025-12-24: disclosed: CVE-2022-50746 published on NVD
- 2022-12-05: patched: Upstream patch c505feba4c0d76084e56ec498ce819f02a7043ae by Gao Xiang
- 2022-12-31: patched: Backport to stable kernels 40c73b2ea9611b5388807be406f30f5e4e1162da