7.5
CVE-2023-32099
- EPSS 0.12%
- Veröffentlicht 18.05.2023 19:15:09
- Zuletzt bearbeitet 21.11.2024 08:02:42
- Quelle product-security@silabs.com
- CVE-Watchlists
- Unerledigt
LoginKey duplication in GSDK
Compiler removal of buffer clearing in sli_se_sign_hash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Silabs ≫ Gecko Software Development Kit Version <= 4.2.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.12% | 0.301 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| product-security@silabs.com | 5.3 | 1.6 | 3.6 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-14 Compiler Removal of Code to Clear Buffers
Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."