CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-23822
https://notcve.org/view.php?id=CVE-2022-23822
27 Apr 2022 — In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication and loading a malicious image onto the device. This in turn may further allow the attacker to perform additional attacks such as such as using the device as a decryption oracle. An anticipated mitigation via a 2022.1 patch will resolve the issue. En este ataque físico, un atacante puede explotar el cargador de arranque de primera etapa (FSBL) del SoC Zynq-7000 evitando la... • https://github.com/Xilinx/embeddedsw/tree/master/lib/sw_apps/zynq_fsbl • CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-27208
https://notcve.org/view.php?id=CVE-2021-27208
15 Mar 2021 — When booting a Zync-7000 SOC device from nand flash memory, the nand driver in the ROM does not validate the inputs when reading in any parameters in the nand’s parameter page. IF a field read in from the parameter page is too large, this causes a buffer overflow that could lead to arbitrary code execution. Physical access and modification of the board assembly on which the Zynq-7000 SoC device mounted is needed to replace the original NAND flash memory with a NAND flash emulation device for this attack to ... • http://www.onfi.org/specifications • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •