CVE Vulnerabilities

CVE-2023-32100

Compiler Removal of Code to Clear Buffers

Published: May 18, 2023 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Compiler removal of buffer clearing in

sli_se_driver_mac_compute

in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.

Weakness

Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka “dead store removal.”

Affected Software

Name Vendor Start Version End Version
Gecko_software_development_kit Silabs * 4.2.1 (including)

Extended Description

This compiler optimization error occurs when:

Potential Mitigations

References