by Kastro
Paper/Archive/CVE-2023-4041

CVE-2023-4041

Silicon Labs Gecko Bootloader — Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 34.1.341 × 206.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.

Affected

ProductAffectedFixed inSource
Gecko Bootloader< 4.3.14.3.1CNA
Gecko Bootloader< 4.2.44.2.4CNA
gecko_bootloader< 4.3.14.3.1CISA-ADP
gecko_bootloader< 4.3.24.3.2CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Silabs (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsiliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000XT8GsQAL?operationContext=S1