Cyber Resilience

CVE-2023-0965

Silabs Gecko Software Development Kit ≤ 4.2.1

Published
18 May 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 3.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0048 39th percentile
Risk Priority 29 floored blend · peak EPSS

Summary

CVE-2023-0965 is a low-severity Compiler Removal of Code to Clear Buffers (CWE-14) vulnerability in Silabs Gecko Software Development Kit. Its CVSS base score is 3.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.

CWE(s)
CWE-14NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-1132Same product: Silabs Gecko Software Development Kit
CVE-2023-32100Same product: Silabs Gecko Software Development Kit
CVE-2023-2481Same product: Silabs Gecko Software Development Kit
CVE-2023-32097Same product: Silabs Gecko Software Development Kit
CVE-2023-32096Same product: Silabs Gecko Software Development Kit
CVE-2023-32098Same product: Silabs Gecko Software Development Kit
CVE-2023-32099Same product: Silabs Gecko Software Development Kit
CVE-2023-3488Same product: Silabs Gecko Software Development Kit
CVE-2023-2747Same product: Silabs Gecko Software Development Kit
CVE-2023-6874Same product: Silabs Gecko Software Development Kit

Affected Assets

silabs
gecko software development kit
≤ 4.2.1

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices include compiler-aware mitigations (volatile, memset_s) that prevent this exact weakness.

PR.DS-10 mostly match
prevents

Explicitly requires removing confidential data from process memory when no longer needed, directly addressing dead-store removal of buffer clears.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect residual sensitive data left by dead-store removal, but does not prevent the weakness itself.

A.8.25 Secure development life cycle partial match
prevents

A secure SDLC can include compiler-flag and code-review requirements that mitigate dead-store removal, yet the control is broader.

A.8.28 Secure coding partial match
prevents

Secure coding rules can mandate explicit volatile or memory-clearing patterns that survive compiler optimization.

References