CVE-2024-22473: Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices
TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability CVE-2024-22473?
CVE-2024-22473 is a defect in the ECDSA signing driver on Virtual Secure Vault devices that allows signature spoofing due to the use of TRNG before initialization.
What is the severity of CVE-2024-22473?
The severity of CVE-2024-22473 is critical, as it can potentially allow an attacker to recreate keys and spoof signatures.
How do I fix CVE-2024-22473?
To fix CVE-2024-22473, update the Gecko SDK to version 4.4.1 or later, where this issue is addressed.
Which software versions are affected by CVE-2024-22473?
CVE-2024-22473 affects Silicon Labs Gecko SDK versions up to and including 4.4.0.
What potential impact does CVE-2024-22473 have on my systems?
The potential impact of CVE-2024-22473 includes the possibility of unauthorized signature generation, resulting in compromised security of applications relying on ECDSA.