CVE-2023-4041

Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability

State: Published
Severity: 9.8 Critical
Published: Aug 23, 2023
Updated: Oct 3, 2024
Reserved: Aug 1, 2023

Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Silabs

Weaknesses

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-787 Out-of-bounds Write
CWE-913 Improper Control of Dynamically-Managed Code Resources

Affected Products

Product	Versions
Gecko BootloaderSilicon Labs	before 4.3.1Affected before 4.2.4Affected 4.3.2Not affected 4.2.4Not affected

References

https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000XT8GsQAL?operationContext=S1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.