{"cve":"CVE-2022-50828","nvd":{"published":"2025-12-30T13:15:57.270","modified":"2026-06-17T05:24:15.507","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nclk: zynqmp: Fix stack-out-of-bounds in strncpy`\n\n\"BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68\"\n\nLinux-ATF interface is using 16 bytes of SMC payload. In case clock name is\nlonger than 15 bytes, string terminated NULL character will not be received\nby Linux. Add explicit NULL character at last byte to fix issues when clock\nname is longer.\n\nThis fixes below bug reported by KASAN:\n\n ==================================================================\n BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68\n Read of size 1 at addr ffff0008c89a7410 by task swapper/0/1\n\n CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.4.0-00396-g81ef9e7-dirty #3\n Hardware name: Xilinx Versal vck190 Eval board revA (QSPI) (DT)\n Call trace:\n  dump_backtrace+0x0/0x1e8\n  show_stack+0x14/0x20\n  dump_stack+0xd4/0x108\n  print_address_description.isra.0+0xbc/0x37c\n  __kasan_report+0x144/0x198\n  kasan_report+0xc/0x18\n  __asan_load1+0x5c/0x68\n  strncpy+0x30/0x68\n  zynqmp_clock_probe+0x238/0x7b8\n  platform_drv_probe+0x6c/0xc8\n  really_probe+0x14c/0x418\n  driver_probe_device+0x74/0x130\n  __device_attach_driver+0xc4/0xe8\n  bus_for_each_drv+0xec/0x150\n  __device_attach+0x160/0x1d8\n  device_initial_probe+0x10/0x18\n  bus_probe_device+0xe0/0xf0\n  device_add+0x528/0x950\n  of_device_add+0x5c/0x80\n  of_platform_device_create_pdata+0x120/0x168\n  of_platform_bus_create+0x244/0x4e0\n  of_platform_populate+0x50/0xe8\n  zynqmp_firmware_probe+0x370/0x3a8\n  platform_drv_probe+0x6c/0xc8\n  really_probe+0x14c/0x418\n  driver_probe_device+0x74/0x130\n  device_driver_attach+0x94/0xa0\n  __driver_attach+0x70/0x108\n  bus_for_each_dev+0xe4/0x158\n  driver_attach+0x30/0x40\n  bus_add_driver+0x21c/0x2b8\n  driver_register+0xbc/0x1d0\n  __platform_driver_register+0x7c/0x88\n  zynqmp_firmware_driver_init+0x1c/0x24\n  do_one_initcall+0xa4/0x234\n  kernel_init_freeable+0x1b0/0x24c\n  kernel_init+0x10/0x110\n  ret_from_fork+0x10/0x18\n\n The buggy address belongs to the page:\n page:ffff0008f9be1c88 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0\n raw: 0008d00000000000 ffff0008f9be1c90 ffff0008f9be1c90 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff\n page dumped because: kasan: bad access detected\n\n addr ffff0008c89a7410 is located in stack of task swapper/0/1 at offset 112 in frame:\n  zynqmp_clock_probe+0x0/0x7b8\n\n this frame has 3 objects:\n  [32, 44) 'response'\n  [64, 80) 'ret_payload'\n  [96, 112) 'name'\n\n Memory state around the buggy address:\n  ffff0008c89a7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff0008c89a7380: 00 00 00 00 f1 f1 f1 f1 00 04 f2 f2 00 00 f2 f2\n >ffff0008c89a7400: 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\n                          ^\n  ffff0008c89a7480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff0008c89a7500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ==================================================================","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0a07b13af04d0db7325018aaa83b5ffe864790c9","https://git.kernel.org/stable/c/5dbfcf7b080306b65d9f756fadf46c9495793750","https://git.kernel.org/stable/c/bce41e4ac6f5ca3b22a07e8cdadc12044bbf9d3b","https://git.kernel.org/stable/c/d66fea97671fcb516bd6d34bcc033f650ac7ee91","https://git.kernel.org/stable/c/d9e2585c3bcecb1c83febad31b9f450e93d2509e"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:18:08.089039631+00:00"},"epss":{"cve":"CVE-2022-50828","score":0.00245,"percentile":0.15829,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}