CVE-2021-44850
Last modified
CVE-2021-44850 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use, an attacker can modify the boot header stored on an SD card so that a secure image appears to be unencrypted, and they will be able to modify the full range of register initialization values. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use, an attacker can modify the boot header stored on an SD card so that a secure image appears to be unencrypted, and they will be able to modify the full range of register initialization values. Normally, these registers will be restricted when booting securely. Of importance to this attack are two registers that control the SD card's transfer type and transfer size. These registers could be modified a way that causes a buffer overflow in the ROM.
Metrics
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Amd | Xilinx Z-7012s Firmware | All versions |
| Amd | Xilinx Z-7014s Firmware | All versions |
| Amd | Xilinx Z-7010 Firmware | All versions |
| Amd | Xilinx Z-7015 Firmware | All versions |
| Amd | Xilinx Z-7020 Firmware | All versions |
| Amd | Xilinx Z-7030 Firmware | All versions |
| Amd | Xilinx Z-7035 Firmware | All versions |
| Amd | Xilinx Z-7045 Firmware | All versions |
| Amd | Xilinx Z-7100 Firmware | All versions |
| Amd | Xilinx Z-7007s Firmware | All versions |
References
- https://support.xilinx.com/s/article/47915Vendor Advisory
- https://support.xilinx.com/s/article/76964Vendor Advisory
- https://support.xilinx.com/s/article/47915Vendor Advisory
- https://support.xilinx.com/s/article/76964Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-44850?
How severe is CVE-2021-44850?
How do I fix CVE-2021-44850?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-44837An issue was discovered in Delta RM 1.2. It is possible for …4.3
- CVE-2021-44838An issue was discovered in Delta RM 1.2. Using the /risque/r…4.3
- CVE-2021-44839An issue was discovered in Delta RM 1.2. It is possible to r…6.5
- CVE-2021-44840An issue was discovered in Delta RM 1.2. Using an privileged…2.7
- CVE-2021-44847A stack-based buffer overflow in handle_request function in …9.8
- CVE-2021-44848In Cibele Thinfinity VirtualUI before 3.0, /changePassword r…5.3
- CVE-2021-44852An issue was discovered in BS_RCIO64.sys in Biostar RACING G…7.8
- CVE-2021-44854An issue was discovered in MediaWiki before 1.35.5, 1.36.x b…5.3
- CVE-2021-44855An issue was discovered in MediaWiki before 1.35.5, 1.36.x b…5.4
- CVE-2021-44856An issue was discovered in MediaWiki before 1.35.5, 1.36.x b…5.3
- CVE-2021-44857An issue was discovered in MediaWiki before 1.35.5, 1.36.x b…6.5
- CVE-2021-44858An issue was discovered in MediaWiki before 1.35.5, 1.36.x b…7.5
Are you affected by CVE-2021-44850?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST