Versal Rf Series Adaptive Socs
Monthly
Boot-time arbitrary code execution is possible on AMD Versal Adaptive SoCs and related Alveo accelerator cards, but only when USB boot mode has been enabled through physical board modifications - a configuration AMD explicitly describes as non-default. A crafted boot image delivered over USB can trigger an out-of-bounds write (CWE-787) that overflows a buffer and overwrites an active function pointer, yielding high confidentiality, integrity, and availability impact confined to the boot process. Because exploitation requires both physical access to the device and a deliberately modified board, plus a non-trivial (high-complexity) overflow, realistic risk is limited to supply-chain, manufacturing, or evil-maid scenarios; no public exploit identified at time of analysis, and no confirmed in-the-wild activity, though the vendor bulletin AMD-SB-8028 documents the issue.
Boot-time arbitrary code execution is possible on AMD Versal Adaptive SoCs and related Alveo accelerator cards, but only when USB boot mode has been enabled through physical board modifications - a configuration AMD explicitly describes as non-default. A crafted boot image delivered over USB can trigger an out-of-bounds write (CWE-787) that overflows a buffer and overwrites an active function pointer, yielding high confidentiality, integrity, and availability impact confined to the boot process. Because exploitation requires both physical access to the device and a deliberately modified board, plus a non-trivial (high-complexity) overflow, realistic risk is limited to supply-chain, manufacturing, or evil-maid scenarios; no public exploit identified at time of analysis, and no confirmed in-the-wild activity, though the vendor bulletin AMD-SB-8028 documents the issue.