CVE-2023-5138
Silabs Gecko Software Development Kit 1.0.0 – 4.4.0
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-5138 is a medium-severity EM-FI (CWE-1319) vulnerability in Silabs Gecko Software Development Kit. Its CVSS base score is 6.8 (Medium).
Operationally, ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-18 (Tamper Resistance and Detection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-57476
Vulnerability Data
Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing initialization through static analysis or test cases.
Tamper-resistance requirements directly drive hardware protections that block EM fault injection from reaching internal state or bypassing checks.
Mandating a tamper-protection program for components forces implementation of EM-FI countermeasures during development and supply-chain handling.
Documented development standards and processes can mandate initialization of critical resources.
Security engineering principles can require explicit resource initialization during design and coding.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Managing physical access directly reduces the opportunity to perform EM-FI attacks.
Secure SDLC practices directly require proper resource initialization as part of coding standards and verification.
Physical-environment monitoring can detect EM-FI attempts or related tampering.
Protecting assets from environmental threats encompasses electromagnetic fault-injection vectors.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can discover EM-FI susceptibility, but does not inherently prevent the weakness in production.
Physical and environmental threat protection directly addresses EM-FI risk through shielding and environmental controls.
Equipment siting and protection can reduce exposure to EM sources but does not specifically target fault-injection vectors.
Secure development life cycle mandates initialization of resources before use.
Application security requirements can specify resource initialization checks.
Secure system architecture principles can include hardware-level countermeasures against EM-FI, though the control is not specific to this threat.