Database/Firmware, BMC & network fabric
AMD Zynq UltraScale+ - CSU runtime service address validation in PMU firmware: The PMU firmware on Zynq UltraScale+
Impact
The PMU firmware on Zynq UltraScale+ devices does not validate addresses when executing Configuration Security Unit runtime services, giving access to isolated or protected memory. Companion to the Versal PLM issue and the same shape: the firmware component that enforces isolation on the device can be steered outside its own boundaries.
Who can reach it
Local to the device, via CSU runtime service calls through the PMU firmware.
What to do
Fixed in updated PMU firmware from AMD/Xilinx. Device firmware update plus card reset, gated on your card integrator shipping it.
References
Related entries
- TCG TPM 2.0 reference implementation (CryptHmacSign): Out-of-bounds read in the reference implementation's HMAC signingCVE-2025-2884 · TCG TPM 2.0 reference implementation (CryptHmacSign)Medium
- Linux kernel (drivers/infiniband/hw/irdma): A stale flag caused the CQ memory-registration path to read one elementCVE-2026-74346 · Linux kernel (drivers/infiniband/hw/irdma)Medium
- Linux kernel InfiniBand connection manager drivers/infiniband/core/cma.c and cm.c - cm_work_handler race: A race in theCVE-2011-0695 · Linux kernel InfiniBand connection manager drivers/infiniband/core/cma.c and cm.c - cm_work_handler raceMedium
- ibacm 1.0.7 (InfiniBand Communication Manager Assistant daemon) - world-writable log and ibacm.port files: The RDMACVE-2012-4518 · ibacm 1.0.7 (InfiniBand Communication Manager Assistant daemon) - world-writable log and ibacm.port filesMedium
- Linux kernel RDMA connection manager drivers/infiniband/core/cma.c - cma_req_handler (RoCE): Pre-authentication remoteCVE-2014-2739 · Linux kernel RDMA connection manager drivers/infiniband/core/cma.c - cma_req_handler (RoCE)Medium
- Cisco Nexus 9000 ACI Mode Switch Software (fabric infrastructure VLAN): The earlier instance of the same ACI class ofCVE-2019-1890 · Cisco Nexus 9000 ACI Mode Switch Software (fabric infrastructure VLAN)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.