TRNG ECDSA Signing Driver Vulnerability Allows Signature Spoofing by Key Recreation
CVE-2024-22473

7.5HIGH

Key Information:

Vendor

silabs.com

Status
GSDK
Vendor
CVE Published:
21 February 2024

What is CVE-2024-22473?

A security vulnerability exists in the Gecko SDK where the True Random Number Generator (TRNG) is utilized before initialization during the ECDSA signing process when exiting EM2/EM3 states on Virtual Secure Vault (VSE) devices. This flaw can potentially be exploited to spoof signatures through key recreation, thereby undermining the security integrity of affected applications. The issue impacts Gecko SDK versions up to and including v4.4.0.

Affected Version(s)

GSDK ARM 0 <= 4.4.0

References

https://community.silabs.com/068Vm000001FrjT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.