CVE-2019-5478

Published: Sep 3, 2019Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot image leading to an incorrect secure boot behavior.

Affected (41)

Products: Amd: Zu11eg Firmware, Zu15eg Firmware, Zu17eg Firmware, Zu19eg Firmware, Zu1cg Firmware, Zu1eg Firmware, Zu21dr Firmware, Zu25dr Firmware, Zu27dr Firmware, Zu28dr Firmware, Zu29dr Firmware, Zu2cg Firmware, Zu2eg Firmware, Zu39dr Firmware, Zu3cg Firmware, Zu3eg Firmware, Zu3tcg Firmware, Zu3teg Firmware, Zu42dr Firmware, Zu43dr Firmware, Zu46dr Firmware, Zu47dr Firmware, Zu48dr Firmware, Zu49dr Firmware, Zu4cg Firmware, Zu4eg Firmware, Zu4ev Firmware, Zu5cg Firmware, Zu5eg Firmware, Zu5ev Firmware, Zu63dr Firmware, Zu64dr Firmware, Zu65dr Firmware, Zu67dr Firmware, Zu6cg Firmware, Zu6eg Firmware, Zu7cg Firmware, Zu7eg Firmware, Zu7ev Firmware, Zu9cg Firmware, Zu9eg Firmware

41 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu11eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu11eg	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu15eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu15eg	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu17eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu17eg	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu19eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu19eg	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu1cg Firmware	All versions

Running on/with	Platform Versions
Amd Zu1cg	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu1eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu1eg	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu21dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu21dr	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu25dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu25dr	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu27dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu27dr	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu28dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu28dr	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu29dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu29dr	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu2cg Firmware	All versions

Running on/with	Platform Versions
Amd Zu2cg	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu2eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu2eg	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu39dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu39dr	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu3cg Firmware	All versions

Running on/with	Platform Versions
Amd Zu3cg	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu3eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu3eg	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu3tcg Firmware	All versions

Running on/with	Platform Versions
Amd Zu3tcg	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu3teg Firmware	All versions

Running on/with	Platform Versions
Amd Zu3teg	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu42dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu42dr	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu43dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu43dr	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu46dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu46dr	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu47dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu47dr	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu48dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu48dr	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu49dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu49dr	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu4cg Firmware	All versions

Running on/with	Platform Versions
Amd Zu4cg	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu4eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu4eg	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu4ev Firmware	All versions

Running on/with	Platform Versions
Amd Zu4ev	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu5cg Firmware	All versions

Running on/with	Platform Versions
Amd Zu5cg	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu5eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu5eg	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu5ev Firmware	All versions

Running on/with	Platform Versions
Amd Zu5ev	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu63dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu63dr	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu64dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu64dr	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu65dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu65dr	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu67dr Firmware	All versions

Running on/with	Platform Versions
Amd Zu67dr	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu6cg Firmware	All versions

Running on/with	Platform Versions
Amd Zu6cg	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu6eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu6eg	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu7cg Firmware	All versions

Running on/with	Platform Versions
Amd Zu7cg	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu7eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu7eg	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu7ev Firmware	All versions

Running on/with	Platform Versions
Amd Zu7ev	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu9cg Firmware	All versions

Running on/with	Platform Versions
Amd Zu9cg	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Amd Zu9eg Firmware	All versions

Running on/with	Platform Versions
Amd Zu9eg	All versions

Related CWEs

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

CWE-657

Violation of Secure Design Principles

The product violates well-established principles for secure design.

References (4)

https://github.com/inversepath/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2019-0001-Xilinx_ZU+-Encrypt_Only_Secure_Boot_bypass.txt

Source: support@hackerone.com

Third Party Advisory

https://www.xilinx.com/support/answers/72588.html

Source: support@hackerone.com

Vendor Advisory

https://github.com/inversepath/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2019-0001-Xilinx_ZU+-Encrypt_Only_Secure_Boot_bypass.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.xilinx.com/support/answers/72588.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.