CVE-2021-27208: Buffer Overflow
When booting a Zync-7000 SOC device from nand flash memory, the nand driver in the ROM does not validate the inputs when reading in any parameters in the nand’s parameter page. IF a field read in from the parameter page is too large, this causes a buffer overflow that could lead to arbitrary code execution. Physical access and modification of the board assembly on which the Zynq-7000 SoC device mounted is needed to replace the original NAND flash memory with a NAND flash emulation device for this attack to be successful.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-27208?
CVE-2021-27208 is classified as a high severity vulnerability due to its potential to lead to arbitrary code execution.
How do I fix CVE-2021-27208?
To fix CVE-2021-27208, ensure that the firmware for the Xilinx Zynq-7000s and Zynq-7000 devices is updated to the latest secure version.
What types of devices are affected by CVE-2021-27208?
CVE-2021-27208 affects Xilinx Zynq-7000 and Zynq-7000s SoC devices that boot from NAND flash memory.
What is the nature of the vulnerability in CVE-2021-27208?
CVE-2021-27208 involves a buffer overflow caused by the NAND driver failing to validate input parameters from the parameter page during boot.
Are there any workarounds for CVE-2021-27208?
Currently, the recommended approach for CVE-2021-27208 is to apply the firmware updates as there are no known effective workarounds.