Medium · 4.6 CVE-2023-41097 EUVD-2023-45617GHSA-67c4-7f3g-r556

Potential Timing vulnerability in CBC PKCS7 padding calculations

Published Dec 21, 2023 · Updated Apr 23, 2025 · Assigned by Silabs

Description

An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.

Affected products

Vendor	Product	Affected	Fixed
silabs.com	GSDK	< 4.4.0	4.4.0

References

https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1 vendor-advisory
https://github.com/SiliconLabs/gecko_sdk/releases patch