Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

Silicon Labs SDK allows non‑secure access to secure memory

CVE-2023-4020 · published 2 years ago
Summary

The Gecko Software Development Kit from Silicon Labs can let code running in the normal (non‑secure) part of a device read or change data that should be kept in the protected (secure) area. This could expose confidential information or let an attacker alter the device’s behavior. Update the SDK to the latest version provided by Silicon Labs, which contains the fix, and verify that any custom code follows the recommended security checks.

What to do
  • Update silabs gecko_software_development_kit to version 4.4.0 or later.
Affected software
VendorProductAffected versions
silabs gecko_software_development_kit >= 1.0.0, < 4.4.0
cpe:2.3:a:silabs:gecko_software_development_kit:*:*:*:*:*:*:*:*
Original advisory text
Unvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memory
An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows reading/writing of memory in the secure region of memory from the non-secure region of memory.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
CWE-787Out-of-bounds Write
Timeline
Published15 Dec 2023
Updated4 Nov 2026
First seen2 Apr 2026
Sources
CVE-2023-4020 · OSV
CVE-2023-4020 · NVD
Track software like this
Free during beta