Zynq Ultrascale Rfsocs
Monthly
Unauthorized code execution during the boot process is possible on AMD Zynq UltraScale+ MPSoC, Zynq UltraScale+ RFSoC, and Kria SOM devices when an attacker with physical or local USB access can drive oversized Device Firmware Upgrade (DFU) download requests while the device is held in USB boot mode. The flaw is an out-of-bounds write (CWE-787) in the USB boot-mode DFU path: missing boundary validation allows the download to overflow the DDR receive buffer and corrupt adjacent First Stage Boot Loader (FSBL) memory before the FSBL hands off to later boot stages. AMD rates this 7.5 (CVSS 4.0 AV:L/AC:L/AT:P/PR:N/UI:N with High confidentiality, integrity, and availability impact to the device); no public exploit code and no confirmed active exploitation were identified at time of analysis, and practical exposure is limited to devices whose boot configuration actually permits USB boot rather than QSPI/eMMC/SD.
Unauthorized code execution during the boot process is possible on AMD Zynq UltraScale+ MPSoC, Zynq UltraScale+ RFSoC, and Kria SOM devices when an attacker with physical or local USB access can drive oversized Device Firmware Upgrade (DFU) download requests while the device is held in USB boot mode. The flaw is an out-of-bounds write (CWE-787) in the USB boot-mode DFU path: missing boundary validation allows the download to overflow the DDR receive buffer and corrupt adjacent First Stage Boot Loader (FSBL) memory before the FSBL hands off to later boot stages. AMD rates this 7.5 (CVSS 4.0 AV:L/AC:L/AT:P/PR:N/UI:N with High confidentiality, integrity, and availability impact to the device); no public exploit code and no confirmed active exploitation were identified at time of analysis, and practical exposure is limited to devices whose boot configuration actually permits USB boot rather than QSPI/eMMC/SD.