Log in Start free

Vulnerability · Published Aug 23, 2023 · Assigned by Silabs

CVE-2023-4041Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability

Critical 9.8

In plain English

A critical-severity buffer overflow in Gecko Bootloader from Silicon Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.4%top 65.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.

Affected products (as reported)

VendorProductVersions
Silicon Labs Gecko Bootloader 0 – before 4.3.10 – before 4.2.4

Weakness: CWE-120, CWE-787, CWE-913 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References