Potential Timing vulnerability in CBC PKCS7 padding calculations

CVE-2023-41097

Summary

Silicon Labs' GSDK for ARM is susceptible to an Observable Timing Discrepancy that could enable a Covert Timing Channel exploitation. This vulnerability makes the system potentially vulnerable to a Padding Oracle Crypto Attack on CBC PKCS7, affecting all versions of GSDK up to 4.4.0. Users of this software should take immediate action to mitigate the risks associated with this vulnerability by updating to the latest version.

References