What is the issue?
Security researchers from Inverse Path at F-Secure uncovered two security flaws in Xilinx's Zynq UltraScale+ products including system-on-chip (SoC), multi-processor system-on-chip (MPSoC), and radio frequency system-on-chip (RFSoC) products.
What are the vulnerabilities?
Researchers noted that the SoC devices support a secure boot mode referred to as ‘Encrypt Only’ that contains two design flaws. These design flaws could allow an attacker to execute arbitrary code by means of boot image tampering, resulting in loss of authentication and confidentiality.
“Given that the internal boot ROM cannot be updated, only a new silicon revision by Xilinx, with an adequately patched boot ROM, can address the first vulnerability,” Security advisory read.
What is the impact?
All Xilinx Zynq UltraScale+ P/Ns are impacted by the vulnerability and the vendor recommend using the hardware root of the trust mode to stay protected, as hardware root boot mode does authenticate the boot and partition headers.
“Xilinx continues to recommend the use of the Hardware Root of Trust (HWRoT) boot mode when possible. The HWRoT boot mode does authenticate the boot and partition headers. For systems that must use the Encrypt Only boot mode, customers are advised to consider system level protections that take into account DPA, unauthenticated boot, and partition header attack vectors,” Xilinx said.