CVE-2023-33552

The CVE-2023-33552 issue affects erofs-utils v1.6, with a Heap Buffer Overflow in erofs_read_one_data (data.c) that can allow arbitrary code execution via a crafted erofs filesystem image. Public references in connected sources confirm the flaw and that Fedora/Mageia advisories backported fixes t...

PT-2025-53209

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-rc6-syzkaller-g09a9639e56c0 Description The Linux kernel contains a flaw related to the handling of erofs filesystem images. Specifically, the kernel does not properly validate the clusterofs value within t...

GSD-2023-1001946 erofs: fix kvcalloc() misuse with __GFP_NOFAIL

erofs: fix kvcalloc misuse with GFPNOFAIL This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.9 by commit...

GSD-2023-1001892 erofs/zmap.c: Fix incorrect offset calculation

erofs/zmap.c: Fix incorrect offset calculation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.10 by commit...

PT-2023-34968 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.10 Description: The issue is related to an incorrect offset calculation in the erofs/zmap.c file. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versio...

GSD-2023-1000818 erofs: Fix pcluster memleak when its block address is zero

erofs: Fix pcluster memleak when its block address is zero This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000817 erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails

erofs: fix missing unmap if zerofsgetextentcompressedlen fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000816 erofs: validate the extent length for uncompressed pclusters

erofs: validate the extent length for uncompressed pclusters This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

PT-2023-33895

Name of the Vulnerable Software and Affected Versions erofs versions prior to v6.0.16 Description The issue is related to a memory leak in the erofs filesystem when its block address is zero. This problem was introduced in Linux Kernel version v5.17 and is fixed in version v6.0.16. The actual...

PT-2023-33893

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.16 Description The issue concerns the validation of the extent length for uncompressed pclusters in erofs. It was introduced in version v4.19 and fixed in Linux Kernel version v6.0.16. The actual impact and...

PT-2025-37672

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.25-android14-5-maybe-dirty-mainline Description The Linux kernel contained an issue where the detection of atomic context was insufficient, potentially leading to problems when z erofs decompressqueue endio w...

GSD-2022-1007737 erofs: fix missing xas_retry() in fscache mode

erofs: fix missing xasretry in fscache mode This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.10 by commit...

PT-2022-35992

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.10 Description The issue is related to a missing xas retry in fscache mode in the erofs component. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel version...

PT-2025-53929

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s erofs file system implementation. A missing unmap operation within the z erofs get extent compressedlen function can lead to memory leaks of meta...

GSD-2022-1006869 erofs: fix order >= MAX_ORDER warning due to crafted negative i_size

erofs: fix order = MAXORDER warning due to crafted negative isize This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

PT-2022-35124 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to a crafted negative i size in erofs, which may cause a warning due to an order greater than or equal to MAX ORDER. The actual impact and attack plausibility have not ye...

GSD-2022-1006372 erofs: fix pcluster use-after-free on UP platforms

erofs: fix pcluster use-after-free on UP platforms This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.68 by commit...

GSD-2022-1006334 erofs: fix pcluster use-after-free on UP platforms

erofs: fix pcluster use-after-free on UP platforms This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.9 by commit...

PT-2022-34591 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.9 Description: The issue is related to a use-after-free error in the pcluster component of the erofs filesystem on UP platforms. The actual impact and attack plausibility have not yet been proven...

PT-2022-34629 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.68 Description: The issue is related to a use-after-free error in the erofs component on UP platforms. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...