Design/Logic Flaw

In fastboot, there is a possible secure boot bypass due to a configuration error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android SoC Android ID: A-202018701...

CVE-2021-39672

In fastboot, there is a possible secure boot bypass due to a configuration error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android SoC Android ID: A-202018701...

CVE-2021-39672

CVE-2021-39672 describes a secure boot bypass in the Fastboot component due to a configuration error, enabling local elevation of privilege with no user interaction. The issue is documented in Android/AOSP risk tables and is listed under Amlogic components in the 2022 February security bulletin. ...

[SECURITY] Fedora 35 Update: microcode_ctl-2.1-47.1.fc35

The microcodectl utility is a companion to the microcode driver written by Tigran Aivazian . The microcode update is volatile and needs to be uploaded on each system boot i.e. it doesn't reflash your cpu permanently, reboot and it reverts back to the old microcode...

CVE-2021-44850

On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use, an attacker can modify the boot header stored on an SD card so that a secure image...

CVE-2021-44850

On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use, an attacker can modify the boot header stored on an SD card so that a secure image...

Buffer overflow

On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use, an attacker can modify the boot header stored on an SD card so that a secure image...

CVE-2021-44850

The CVE covers Xilinx Zynq-7000 SoC, where physical modification of an SD boot image enables a ROM buffer overflow. The boot image header is unencrypted/unauthenticated pre-use, allowing an attacker to modify the SD card’s boot header so a secure image appears unencrypted and register initializat...

CVE-2021-44850

On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use, an attacker can modify the boot header stored on an SD card so that a secure image...

PT-2022-12245 · Xilinx · Xilinx Zynq-7000 Soc

Name of the Vulnerable Software and Affected Versions: Xilinx Zynq-7000 SoC devices affected versions not specified Description: The issue concerns a buffer overflow attack in the ROM of Xilinx Zynq-7000 SoC devices. This attack is possible due to the physical modification of an SD boot image,...

Xilinx Zynq-7000 数据伪造问题漏洞

The Xilinx Zynq-7000 is a chip from Xilinx, Inc. The Xilinx Zynq-7000 SoC provides the software programmability of an ARM® architecture processor with the hardware programmability of an FPGA for critical analytics and hardware acceleration while integrating CPU, DSP, ASSP, and hybrid signaling on...

CVE-2022-22566

Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access DMA vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device...

CVE-2022-22566

Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access DMA vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device...

CVE-2022-22566

CVE-2022-22566 affects Dell Client Commercial and Consumer platforms, involving a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access could potentially exploit the flaw to execute arbitrary code on the device. CVSSv3.1 base score is 7.2 (HIGH); attack...

AlmaLinux 8 : kernel (ALSA-2021:2570)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2570 advisory. - The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database aka dbx protection mechanism. This affects...

AlmaLinux 8 : fwupd (ALSA-2021:2566)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:2566 advisory. - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw...

AlmaLinux 8 : shim (ALSA-2021:1734)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1734 advisory. - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw...

AlmaLinux 8 : grub2 (ALSA-2021:0696)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:0696 advisory. - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

CVE-2022-0317

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...