CVE detail

CVE-2021-27208 — CVE-2021-27208

Published 2021-03-15 · Modified 2026-06-17 · Vendor xilinx · Product zynq-7000s_firmware · Source nvd
MEDIUM
severity
CVSS-derived band
6.8
CVSS v3
0–10 scale
0.0038
EPSS probability
exploitation probability, 30d
31.0%
EPSS percentile
percentile vs all CVEs
NOT LISTED
CISA KEV
known exploited catalog

Description

When booting a Zync-7000 SOC device from nand flash memory, the nand driver in the ROM does not validate the inputs when reading in any parameters in the nand’s parameter page. IF a field read in from the parameter page is too large, this causes a buffer overflow that could lead to arbitrary code execution. Physical access and modification of the board assembly on which the Zynq-7000 SoC device mounted is needed to replace the original NAND flash memory with a NAND flash emulation device for this attack to be successful.

Remediation

No vendor-published fix data in our corpus for this CVE. Check the references below or the vendor's PSIRT / security advisories page.

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.