CVE-2022-50828
Stack-Out-Of-Bounds in Linux Kernel ZynqMP Clock Driver
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xilinx | zynqmp | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stack-out-of-bounds error in the Linux kernel's zynqmp clock driver. It occurs because the Linux-ATF interface uses a 16-byte SMC payload, but if the clock name is longer than 15 bytes, the terminating NULL character is not received by Linux. This causes strncpy to write beyond the allocated stack buffer, leading to a stack-out-of-bounds bug detected by KASAN (Kernel Address Sanitizer). The issue is fixed by explicitly adding a NULL character at the last byte to prevent the overflow.
How can this vulnerability impact me? :
This vulnerability can cause a stack-out-of-bounds memory access in the Linux kernel, which may lead to kernel crashes or undefined behavior. Such memory corruption issues can potentially be exploited to cause denial of service or escalate privileges, impacting system stability and security.