CVE-2024-22473 Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices
Attackers can spoof signatures by recreating keys due to uninitialized TRNG usage in ECDSA signing on Silicon Labs VSE devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22473?
CVE-2024-22473 is a medium-severity vulnerability in silabs.com GSDK, published on 21 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.
Which versions are affected by CVE-2024-22473?
It affects 1 product.
Products include Silabs Gecko Software Development Kit.
How do I fix CVE-2024-22473?
No fix has been published for CVE-2024-22473 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-22473 being exploited?
There is no known exploitation of CVE-2024-22473 in the wild and no public exploit code.
Other vulnerabilities in silabs.com GSDK
- CVE-2023-45318 Memory corruption in Gecko Platform
- CVE-2023-2686 Memory corruption in Gecko Platform
- CVE-2023-4280 Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory region
- CVE-2023-4020 Unvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memory
- CVE-2023-25181 Memory corruption in Cesium NET
Sources
Also known as GHSA-xhg6-78jc-3cwf.