PT-2022-12245 · Xilinx · Xilinx Zynq-7000 Soc

Published 2022-02-10 · Updated 2023-08-08 · CVE-2021-44850

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xilinx Zynq-7000 SoC devices (affected versions not specified)

Description The issue concerns a buffer overflow attack in the ROM of Xilinx Zynq-7000 SoC devices. This attack is possible due to the physical modification of an SD boot image, which allows an attacker to modify the boot header stored on an SD card. As a result, a secure image can appear to be unencrypted, enabling the modification of register initialization values that are normally restricted during secure booting. Specifically, two registers controlling the SD card's transfer type and transfer size can be modified to cause a buffer overflow in the ROM.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2021-44850

Affected Products

Xilinx Zynq-7000 Soc

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-44850 · Security Note
• https://support.xilinx.com/s/article/47915 · Vendor Advisory
• https://support.xilinx.com/s/article/76964 · Vendor Advisory
• https://t.me/cvenotify/26921 · Telegram Post
• https://t.me/cibsecurity/37255 · Telegram Post