The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - loop: Check for overflow while configuring loop The userspace can configure a loop using an ioctl call,     wherein a configuration of type loop_config is passed (see lo_ioctl()'s case on line 1550 of     drivers/block/loop.c). This proceeds to call loop_configure() which in turn calls     loop_set_status_from_info() (see line 1050 of loop.c), passing &config->info which is of type     loop_info64*. This function then sets the appropriate values, like the offset. loop_device has lo_offset     of type loff_t (see line 52 of loop.c), which is typdef-chained to long long, whereas loop_info64 has     lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h). The function directly copies offset     from info to the device as follows (See line 980 of loop.c): lo->lo_offset = info->lo_offset; This results     in an overflow, which triggers a warning in iomap_iter() due to a call to iomap_iter_done() which has:
    WARN_ON_ONCE(iter->iomap.offset > iter->pos); Thus, check for negative value during     loop_set_status_from_info(). Bug report:
    https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e (CVE-2022-49993)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2022-49993

medium Nessus Plugin ID 249462

Version 1.6

Version 1.5

Version 1.3

Version 1.6 Sep 25, 2025, 11:29 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202509252329
Version 1.5 Sep 14, 2025, 2:50 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202509141450
Version 1.3 Sep 4, 2025, 5:30 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509041730