PT-2024-13059 · Silicon · Gecko Sdk

Published 2024-01-02 · Updated 2024-09-25 · CVE-2023-4280

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gecko SDK versions 4.3.x and earlier

Description The issue is related to an unvalidated input in the Silicon Labs TrustZone implementation, allowing an attacker to access the trusted region of memory from the untrusted region.

Recommendations For versions 4.3.x and earlier, update to a version that includes a fix for the unvalidated input issue in the Silicon Labs TrustZone implementation. As a temporary workaround, consider restricting access to the trusted region of memory to minimize the risk of exploitation.

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

CVE-2023-4280

Affected Products

Gecko Sdk

References · 7

• https://osv.dev/vulnerability/CVE-2023-4280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4280 · Security Note
• https://github.com/SiliconLabs/gecko_sdk · Note
• https://t.me/cvenotify/66773 · Telegram Post
• https://twitter.com/CVEnew/status/1742232899313684819 · Twitter Post
• https://t.me/cibsecurity/74185 · Telegram Post
• https://community.silabs.com/069Vm0000004NinIAE · Note