CVE-2023-41097

2023-12-2121:15:08

CWE-203

CWE-385

CWE-208

[email protected]

web.nvd.nist.gov

cve-2023-41097

silabs

gsdk

arm

padding oracle

crypto attack

cbc pkcs7

vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

JSON

An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.

CPE configuration

NVD

silabsgecko_software_development_kitRange≤4.4.0

CPENameOperatorVersion
silabs:gecko_software_development_kitsilabs gecko software development kitle4.4.0

CPE	Name	Operator	Version
silabs:gecko_software_development_kit	silabs gecko software development kit	le	4.4.0

CNA Affected

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "ARM"
    ],
    "product": "GSDK",
    "repo": "https://github.com/SiliconLabs/gecko_sdk/releases",
    "vendor": "silabs.com",
    "versions": [
      {
        "lessThan": "4.4.0",
        "status": "affected",
        "version": "0",
        "versionType": "LessThan"
      }
    ]
  }
]