CVE-2024-22473
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD
Description
TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.
Affected (1)
Products: Silabs: Gecko Software Development Kit
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 4.4.0 |
Related CWEs
CWE-1279
Cryptographic Operations are run Before Supporting Units are Ready
Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
CWE-331
Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
References (2)
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required
Timeline
No history available yet.