PT-2019-17698 · Xilinx · Xilinx Zynq Ultrascale+

Published 2019-09-03 · Updated 2024-11-27 · CVE-2019-5478

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Xilinx Zynq UltraScale+ devices (affected versions not specified)

Description A weakness was found in the Encrypt Only boot mode, which could allow an adversary to modify the control fields of the boot image. This modification could lead to incorrect secure boot behavior.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

CWE-657

Related Identifiers

CVE-2019-5478

Affected Products

Xilinx Zynq Ultrascale+

References · 3

• https://xilinx.com/support/answers/72588.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5478 · Security Note
• https://github.com/inversepath/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2019-0001-Xilinx_ZU+-Encrypt_Only_Secure_Boot_bypass.txt · Note