CVE-2022-24939

CVE-2022-24939 affects the Ember ZNet stack (as per multiple sources). A malformed packet with an invalid destination address triggers a stack overflow, which causes an assertion and a reset that clears the error. Documented impact is availability-related (HIGH), with adjacent network access and ...

CVE-2023-31247

CVE-2023-31247 concerns a memory corruption in the HTTP Server Host header parsing of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can trigger code execution. Talos confirms this as a vulnerability affecting Weston Embedded uC-HTTP v3.01.01 and related platforms (Cesium NE...

CVE-2023-5138

CVE-2023-5138 concerns Silicon Labs Gecko SDK on secure vault high parts EFx32xG2xB. The Cortex-M33 core in these devices does not have glitch detection enabled by default, except on the EFR32xG21B variant. Technical details across sources indicate the vulnerability stems from the default configu...

CVE-2023-45318

Weston Embedded uC-HTTP-server (CVE-2023-45318) suffers a heap-based buffer overflow in Protocol Version parsing of HTTP requests, triggered by a misupdated RxBufLenRem during HTTPsReq_ProtocolVerParse, enabling arbitrary code execution. Affected: Weston Embedded uC-HTTP git commit 80d4004 (and r...

CVE-2023-24585

CVE-2023-24585 affects Weston Embedded uC-HTTP v3.01.01, specifically the HTTP Server functionality. The vulnerability is an out-of-bounds write that occurs while parsing an HTTP request method, which can lead to memory corruption (including heap corruption). An attacker can trigger this by sendi...

CVE-2023-28391

CVE-2023-28391 : Talos reports a memory corruption vulnerability in Weston Embedded uC-HTTP v3.01.01’s HTTP Server header parsing. A crafted network packet can trigger a one-byte NULL overwrite during header value length handling, which, via heap corruption in uC-LIB Mem_DynPool, may allow an att...

CVE-2023-28379

Cisco Talos details a normal-mode vulnerability: CVE-2023-28379 is a memory corruption in Weston Embedded uC-HTTP HTTP Server form boundary handling (uC-HTTP v3.01.01). TALOS-2023-1738 confirms the issue as a heap-based overflow when parsing the form boundary string, where the boundary length is ...

CVE-2023-27882

Talos advisory TALOS-2023-1733 documents a heap-based buffer overflow in Weston Embedded uC-HTTP server form boundary handling (v3.01.01), enabling code execution via a specially crafted network packet. Affected products/versions listed: Weston Embedded uC-HTTP v3.01.01, Cesium NET 3.07.01, Silic...

CVE-2023-6387

The CVE-2023-6387 issue is in Silicon Labs Gecko SDK, specifically the Bluetooth LE HCI CPC sample application. The core problem is a potential buffer overflow in the sample code, which could lead to denial of service or remote code execution. Impact is rated HIGH (CVSS 3.1: AV:A, AC:H, PR:N, UI:...

CVE-2023-25181

CVE-2023-25181 is a heap-based buffer overflow in the HTTP Server of Weston Embedded uC-HTTP v3.01.01. Talos confirms a specially crafted network packet can trigger an integer underflow in Protocol Version parsing, leading to arbitrary code execution. Vulnerable versions include Weston Embedded u...

CVE-2024-0240

CVE-2024-0240 describes a memory leak in Silicon Labs’ Bluetooth stack for EFR32 products that can exhaust memory when sending notifications to multiple clients, causing all Bluetooth operations (advertising, scanning) to stop. Affected component is the Silicon Labs Bluetooth stack for EFR32; roo...

CVE-2023-2747

The CVE-2023-2747 issue concerns an uninitialized initialization vector (IV) used by the Secure Engine (SE) to encrypt data stored in SE flash memory, impacting Silicon Labs Gecko SDK/SE firmware. Concrete details from connected documents indicate the affected firmware range is Gecko SE firmware ...

CVE-2023-3024

CVE-2023-3024 concerns the Bluetooth LE stack: forcing segmentation of 'prepare write response' packets can cause an out-of-bounds memory access. The vulnerability is documented across sources (NVD, Red Hat, CVE listing, CNNVD, Vulnrichment, etc.) and is described as a memory access violation in ...

CVE-2023-41097

CVE-2023-41097 concerns Silicon Labs Gecko SDK (GSDK) on ARM, where an Observable Timing Discrepancy could enable a Padding Oracle crypto attack against CBC PKCS7. Affected component is the GSDK up to and including version 4.4.0. The root cause is a timing discrepancy that leaks information durin...

CVE-2023-4280

Silicon Labs Gecko SDK, v4.3.x and earlier, contains an unvalidated input issue in the TrustZone implementation that lets an attacker access the trusted memory region from the untrusted region. Affected component: TrustZone in Gecko SDK. Root cause: unvalidated input allowing cross-region access....

CVE-2024-22473

Gecko SDK vulnerability CVE-2024-22473 involves TRNG used before initialization by the ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. Affected software: Gecko SDK versions through 4.4.0 (and earlier per multiple sources). Impact: potential signature spoofing via ...

CVE-2023-3488

CVE-2023-3488 affects Silicon Labs Gecko SDK (GSDK) up to v4.3.0, where an uninitialized buffer in the GBL parser can allow a attacker to leak data from the Secure stack via a malformed GBL file. The vulnerability is triggered when processing a GBL file, with local attack vector and required user...

CVE-2023-6874

CVE-2023-6874 affects Silicon Labs EmberZNet prior to version 7.4.0. The vulnerability arises from the ability to manipulate the NWK (network) sequence number, enabling a denial-of-service condition. Impact is limited to Ember ZNet components handling NWK sequencing in affected releases, with no ...

CVE-2023-0775

The CVE-2023-0775 entry concerns Silicon Labs Gecko SDK Bluetooth LE stack. A malformed/invalid prepare write request command can exhaust memory, causing the LE stack to fail to handle subsequent connection requests and triggering a denial of service. Documents consistently tie this to the Gecko ...

CVE-2023-1132

CVE-2023-1132 affects Silicon Labs Gecko Platform SDK (Gecko Platform SDK) versions 4.2.1 and earlier. The root cause is the compiler removing the buffer clearing in the sli_se_driver_key_agreement function, which can cause key material to be duplicated in RAM. Documented impact indicates exposur...

CVE-2023-32096

The vulnerability CVE-2023-32096 affects Silicon Labs Gecko Platform SDKs prior to or including 4.2.1, where the compiler removal of a buffer clear in the function sli_crypto_transparent_aead_encrypt_tag can cause key material to be duplicated in RAM. This can expose sensitive material within mem...

CVE-2023-32099

In Silicon Labs Gecko Platform SDK (GSDK) the vulnerability CVE-2023-32099 arises from compiler removal of a buffer clearing in the sli_se_sign_hash function, causing key material to be duplicated in RAM. Affected products are Gecko Platform SDK versions 4.2.1 and earlier. Impact is described as ...

CVE-2023-32100

Summary: CVE-2023-32100 affects Silicon Labs Gecko Platform SDK (GSDK) up to v4.2.1. The vulnerability stems from compiler removal of buffer clearing in sli_se_driver_mac_compute, leading to key material being duplicated into RAM. This is documented across multiple feeds (NVD entry for CVE-2023-3...

CVE-2023-2481

The CVE-2023-2481 issue affects Silicon Labs Gecko Platform SDK versions 4.2.1 and earlier, caused by the compiler removing buffer clearing in the function sli_se_opaque_import_key, which can lead to key material being duplicated in RAM. This has direct confidentiality impact as sensitive keys ma...

CVE-2023-0965

CVE-2023-0965 : In Silicon Labs Gecko Platform SDK, the compiler failed to clear buffers in the function sli_cryptoacc_transparent_key_agreement , causing the key material to be duplicated in RAM. Affected: Gecko Platform SDK v4.2.1 and earlier. Impact: potential exposure of key material in RAM. ...

CVE-2023-32097

The CVE-2023-32097 vulnerability affects Silicon Labs Gecko Platform SDK (GSDK) up to v4.2.1, specifically the function sli_crypto_transparent_aead_decrypt_tag. A compiler optimization removed a buffer-clearing operation, which can cause key material to be duplicated in RAM. This is characterized...

CVE-2023-2687

The CVE-2023-2687 issue affects Silicon Labs Gecko SDK, specifically versions 4.2.1 and earlier, where a vulnerability in the Platform CLI component allows a heap-overflow that can overwrite limited structures. The available connected sources confirm the affected product (Gecko SDK) and the root ...

CVE-2023-32098

The vulnerability CVE-2023-32098 affects Silicon Labs Gecko Platform SDK (Gecko SDK) up to v4.2.1. The root cause is a compiler removal of a buffer-clearing operation in sli_se_sign_message, which results in key material being duplicated in RAM. Documented impact is exposure of sensitive key mate...

CVE-2023-2686

CVE-2023-2686 describes a buffer overflow in the Silicon Labs Gecko SDK (MicriumOS example) prior to v4.2.3, enabling a connected device to write a payload onto the stack. The issue affects Gecko SDK 4.2.3 and earlier, with a network-exposed impact and high severity (CVSS v3.1: CRITICAL). The roo...

CVE-2023-4020

Summary: CVE-2023-4020 involves Silicon Labs TrustZone where an unvalidated input in a memory-communication library function allows reading/writing secure memory from non-secure memory. The issue is confirmed across multiple sources (NVD, Red Hat) describing an input-validation flaw in the TrustZ...