CVE-2023-51392: Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM
Published Feb 23, 2024
·Updated
Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.
Affected Software
2 affected components
Silabs Emberznet>=7.2.0<=7.2.4
Silicon Labs Ember ZNet>=7.2.0<7.4.0
Event History
Feb 23, 2024
CVE Published
via MITRE·04:12 PM
Data Sourced
via MITRE·04:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
May 26, 57089
Event
via NVD·07:03 AM
Frequently Asked Questions
1
What is the severity of CVE-2023-51392?
CVE-2023-51392 has a moderate severity due to its potential for side-channel attacks.
2
How do I fix CVE-2023-51392?
To fix CVE-2023-51392, update your Ember ZNet SDK to a version above 7.4.0.
3
Which versions of Silicon Labs Ember ZNet are affected by CVE-2023-51392?
CVE-2023-51392 affects Ember ZNet SDK versions between 7.2.0 and 7.4.0.
4
What type of attacks does CVE-2023-51392 expose systems to?
CVE-2023-51392 potentially exposes systems to electromagnetic and differential power analysis side-channel attacks.
5
Is there a workaround for CVE-2023-51392?
There are no confirmed workarounds for CVE-2023-51392, so upgrading is the recommended solution.