Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - clkzynqmp修复 strncpy` 中的堆栈越界缺陷KASANstrncpy+0x30/0x68 Linux-ATF 接口中的堆栈越界使用 16 字节的 SMC 负载。如果时钟名称超过 15 个字节Linux 将不会接收以空字符结尾的字符串。在最后一个字节添加明确的空字符以修复时钟名称较长时出现的问题。此更新修复了 KASAN 报告的以下缺陷
    ================================================== ================ 缺陷KASAN由任务 swapper/0/1 CPU1 执行的 strncpy+0x30/0x68 地址 ffff0008c89a7410 大小为 1 的读取中发生堆栈越界PID：1 通讯：
    swapper/0 未受感染 5.4.0-00396-g81ef9e7-dirty #3 硬件名称：Xilinx Versal vck190 评估板 revA (QSPI) (DT) 调用跟踪dump_backtrace+0x0/0x1e8 show_stack+0x14/0x20 dump_stack+0xd4/0x108 print_address_description .isra.0+0xbc/0x37c __kasan_report+0x144/0x198 kasan_report+0xc/0x18
    __asan_load1+0x5c/0x68 strncpy+0x30/0x68 zynqmp_clock_probe+0x238/0x7b8 platform_drv_probe+0x6c/0xc8 really_probe+0x14c/0x418 driver_probe_device+0x74/0x130 __device_attach_driver+0xc4/0xe8 bus_for_each_drv+0xec/0x150 __device_attach+0x160/0x1d8 device_initial_probe+0x10/0x18 bus_probe_device+0xe0/0xf0 device_add+0x528/0x950 of_device_add+0x5c/0x80 of_platform_device_create_pdata+0x120/0x168 of_platform_bus_create+0x244/0x4e0 of_platform_populate+0x50/0xe8 zynqmp_firmware_probe+0x370/0x3a8 platform_drv_probe+0x6c/0xc8 really_probe+0x14c/0x418 driver_probe_device+0x74/0x130 device_driver_attach+0x94/0xa0
    __driver_attach+0x70/0x108 bus_for_each_dev+0xe4/0x158 driver_attach+0x30/0x40 bus_add_driver+0x21c/0x2b8 driver_register+0xbc/0x1d0 __platform_driver_register+0x7c/0x88 zynqmp_firmware_driver_init+0x1c/0x24 do_one_initcall+0xa4/0x234 kernel_init_freeable+0x1b0/0x24c kernel_init+0x10/0x110 ret_from_fork+0x10/0x18 The buggy address belongs to the page: page:ffff0008f9be1c88 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 raw: 0008d00000000000 ffff0008f9be1c90 ffff0008f9be1c90 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff page dumped because: kasan: bad access detected addr ffff0008c89a7410位于任务 swapper/0/1 的堆栈中 frame:
    zynqmp_clock_probe+0x0/0x7b8 此帧有 3 个对象[32, 44) 'response' [64, 80) 'ret_payload' [96, 112) 'name' 围绕缺陷地址的内存状态ffff0008c89a7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0008c89a7380: 00 00 00 00 f1 f1 f1 f1 00 04 f2 f2 00 00 f2 f2 >ffff0008c89a7400: 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff0008c89a7480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0008c89a750000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================ ================================================== (CVE-2022-50828)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2022-50828

medium Nessus 插件 ID 281736

版本 1.4