Lucene search

SilabsCVELIST:CVE-2023-4280

HistoryJan 02, 2024 - 4:52 p.m.

CVE-2023-4280 Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory region

2024-01-0216:52:06

CWE-20

CWE-787

CWE-125

Silabs

www.cve.org

cve-2023-4280

silicon labs

trustzone

gecko sdk

unvalidated input

memory region

9.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.5%

JSON

An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "GSDK",
    "vendor": "silabs.com",
    "versions": [
      {
        "lessThanOrEqual": "4.3.x",
        "status": "affected",
        "version": "1.0",
        "versionType": "patch"
      }
    ]
  }
]

References

community.silabs.com/069Vm0000004NinIAE

github.com/SiliconLabs/gecko_sdk

9.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.5%

JSON

Related for CVELIST:CVE-2023-4280