CVE-2023-41097

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-41097
An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.

4.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/SiliconLabs/gecko_sdk/releases Release Notes
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1 Permissions Required
https://github.com/SiliconLabs/gecko_sdk/releases Release Notes
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1 Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:silabs:gecko_software_development_kit:*:*:*:*:*:*:*:*
History

21 Nov 2024, 08:20

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 4.6
References () https://github.com/SiliconLabs/gecko_sdk/releases - Release Notes () https://github.com/SiliconLabs/gecko_sdk/releases - Release Notes
References () https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1 - Permissions Required () https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1 - Permissions Required

25 Sep 2024, 17:15

Type Values Removed Values Added
Summary (en) An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0. (en) An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.
CWE CWE-385 CWE-327

03 Jan 2024, 17:22

Type Values Removed Values Added
CPE cpe:2.3:a:silabs:gecko_software_development_kit:*:*:*:*:*:*:*:*
CWE CWE-203
CVSS v2 : unknown
v3 : 4.6 		v2 : unknown
v3 : 7.5
References () https://github.com/SiliconLabs/gecko_sdk/releases - () https://github.com/SiliconLabs/gecko_sdk/releases - Release Notes
References () https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1 - () https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1 - Permissions Required
First Time Silabs gecko Software Development Kit
Silabs

22 Dec 2023, 12:18

Type Values Removed Values Added
Summary
  • (es) Una discrepancia de tiempo observable, vulnerabilidad de canal de tiempo oculto en Silabs GSDK en ARM potencialmente permite un ataque de Padding Oracle Crypto en CBC PKCS7. Este problema afecta a GSDK: hasta 4.4.0.

21 Dec 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-21 21:15

Updated : 2024-11-21 08:20

NVD link : CVE-2023-41097

Mitre link : CVE-2023-41097

CVE.ORG link : CVE-2023-41097

JSON object : View

Products Affected

silabs

  • gecko_software_development_kit
CWE
CWE-208

Observable Timing Discrepancy

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-203

Observable Discrepancy