CVE-2021-27208

Katalog CVE

CVSS 6.8 · Medium EPSS 0,39%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada xilinx zynq-7000s firmware, xilinx zynq-7000 firmware. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

When booting a Zync-7000 SOC device from nand flash memory, the nand driver in the ROM does not validate the inputs when reading in any parameters in the nand’s parameter page. IF a field read in from the parameter page is too large, this causes a buffer overflow that could lead to arbitrary code execution. Physical access and modification of the board assembly on which the Zynq-7000 SoC device mounted is needed to replace the original NAND flash memory with a NAND flash emulation device for this attack to be successful.

Rincian

Terbit di NVD

15 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.xilinx.com/products/silicon-devices/soc/zynq-7000.html product · advisory vendor
• https://www.xilinx.com/support/answers/76201.html advisory vendor
• http://www.onfi.org/specifications not applicable