CVE-2022-50828

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.4.0-00396-g81ef9e7-dirty

Description The Linux kernel contains a stack-out-of-bounds write issue in the strncpy function within the zynqmp clock driver. This occurs when the clock name exceeds 15 bytes, leading to a missing null terminator and potential buffer overflow. The issue was identified through Kernel Address Sanitizer (KASAN) reporting a bug in the zynqmp clock probe function. The Linux-ATF interface uses 16 bytes of SMC payload, and when the clock name is longer than 15 bytes, the null terminator is not correctly received by Linux.

Recommendations Update to Linux kernel version 5.4.0-00396-g81ef9e7-dirty or a later version to address this issue.