Vulnerability · Published Jan 7, 2025 · Assigned by Silabs
CVE-2024-8361DoS caused due to wrong hash length returned for SHA2/224 algorithm
High 7.5
In plain English
A high-severity security flaw in WiSeConnect SDK from silabs.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 61.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subsequently causes a Denial of Service (DoS). If a watchdog is implemented, device will restart after watch dog expires. If watchdog is not implemented, device can be recovered only after a hard reset
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| silabs.com | WiSeConnect SDK | 0 – through 3.3.4 |
Weakness: CWE-131, CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://community.silabs.com/068Vm00000I7zqo vendor-advisory, permissions-required