CVE-2024-22473mediumCWE-1279CWE-331

CVE-2024-22473: medium-severity vulnerability in silabs.com GSDK

Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices

Published · Updated

Follow this CVE+ Monitor GSDK

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.4%
In short

A random number generator used for digital signatures isn't properly initialized when a device wakes up from sleep mode, potentially allowing attackers to forge digital signatures by recreating the keys used to sign them.

Technical detail

The TRNG (True Random Number Generator) is accessed by the ECDSA signing driver before initialization upon exit from EM2/EM3 sleep states on VSE devices, creating a predictable cryptographic state. This enables signature spoofing via key recreation due to insufficient entropy during the critical initialization window. Affected Gecko SDK versions through v4.4.0.

Summary generated and translated by AI from the official description.
TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected products
silabs.com · GSDK
Related CVEs — silabs.com GSDK

In the same product, most dangerous first.

CVE-2023-6387HIGHIncorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflowEPSS 0.6%CVE-2023-4020CRITICALUnvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memoryEPSS 0.6%CVE-2023-4280CRITICALUnvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory regionEPSS 0.4%CVE-2024-0240MEDIUMSilicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clientsEPSS 0.4%CVE-2023-6874HIGHZigbee Unauthenticated DoS via NWK Sequence number manipulationEPSS 0.4%CVE-2023-0775MEDIUMBluetooth LE Invalid prepare write request command leads to denial of serviceEPSS 0.3%