PT-2022-16284 · Xilinx · Xilinx Zynq-7000 Soc

Published 2022-04-27 · Updated 2022-05-09 · CVE-2022-23822

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xilinx Zynq-7000 SoC (affected versions not specified)

Description The issue concerns a physical attack where an attacker can potentially exploit the First Stage Boot Loader (FSBL) by bypassing authentication and loading a malicious image onto the device. This could allow the attacker to perform additional attacks, such as using the device as a decryption oracle.

Recommendations For all affected versions, apply the anticipated 2022.1 patch to resolve the issue. As a temporary workaround, consider restricting physical access to the device to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-23822

Affected Products

Xilinx Zynq-7000 Soc

References · 4

• https://osv.dev/vulnerability/CVE-2022-23822 · Vendor Advisory
• https://support.xilinx.com/s/article/76974 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23822 · Security Note
• https://github.com/Xilinx/embeddedsw/tree/master/lib/sw_apps/zynq_fsbl · Note