In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication and loading a malicious image onto the device. This in turn may further allow the attacker to perform additional attacks such as such as using the device as a decryption oracle. An anticipated mitigation via a 2022.1 patch will resolve the issue.
References
| Link | Resource |
|---|---|
| https://github.com/Xilinx/embeddedsw/tree/master/lib/sw_apps/zynq_fsbl | Third Party Advisory |
| https://support.xilinx.com/s/article/76974 | Vendor Advisory |
Configurations
History
09 May 2022, 16:33
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:xilinx:zynq-7000s_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:xilinx:zynq-7000s:-:*:*:*:*:*:*:* cpe:2.3:h:xilinx:zynq-7000:-:*:*:*:*:*:*:* cpe:2.3:o:xilinx:zynq-7000_firmware:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 4.4
v3 : 6.8 |
| References | (MISC) https://support.xilinx.com/s/article/76974 - Vendor Advisory | |
| References | (MISC) https://github.com/Xilinx/embeddedsw/tree/master/lib/sw_apps/zynq_fsbl - Third Party Advisory | |
| CWE | CWE-863 |
27 Apr 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-27 17:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-23822
Mitre link : CVE-2022-23822
CVE.ORG link : CVE-2022-23822
JSON object : View
Products Affected
xilinx
- zynq-7000
- zynq-7000_firmware
- zynq-7000s
- zynq-7000s_firmware
CWE
CWE-863
Incorrect Authorization