Cyber Resilience

CVE-2023-5138

Silabs Gecko Software Development Kit 1.0.0 – 4.4.0

Published
03 January 2024
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 6.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 20th percentile
Risk Priority 49 floored blend · peak EPSS

Summary

CVE-2023-5138 is a medium-severity EM-FI (CWE-1319) vulnerability in Silabs Gecko Software Development Kit. Its CVSS base score is 6.8 (Medium).

Operationally, ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-18 (Tamper Resistance and Detection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.

CWE(s)

Related Threats

CVEs Like This One

CVE-2023-1132Same product: Silabs Gecko Software Development Kit
CVE-2023-32100Same product: Silabs Gecko Software Development Kit
CVE-2023-2481Same product: Silabs Gecko Software Development Kit
CVE-2023-32096Same product: Silabs Gecko Software Development Kit
CVE-2023-32099Same product: Silabs Gecko Software Development Kit
CVE-2024-0240Same product: Silabs Gecko Software Development Kit
CVE-2023-0775Same product: Silabs Gecko Software Development Kit
CVE-2023-6874Same product: Silabs Gecko Software Development Kit
CVE-2023-2747Same product: Silabs Gecko Software Development Kit
CVE-2023-2687Same product: Silabs Gecko Software Development Kit

Affected Assets

silabs
gecko software development kit
1.0.0 — 4.4.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation can discover missing initialization through static analysis or test cases.

Tamper-resistance requirements directly drive hardware protections that block EM fault injection from reaching internal state or bypassing checks.

Mandating a tamper-protection program for components forces implementation of EM-FI countermeasures during development and supply-chain handling.

Documented development standards and processes can mandate initialization of critical resources.

Security engineering principles can require explicit resource initialization during design and coding.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-06 mostly match
prevents

Managing physical access directly reduces the opportunity to perform EM-FI attacks.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper resource initialization as part of coding standards and verification.

DE.CM-02 partial match
prevents

Physical-environment monitoring can detect EM-FI attempts or related tampering.

PR.IR-02 partial match
prevents

Protecting assets from environmental threats encompasses electromagnetic fault-injection vectors.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development can discover EM-FI susceptibility, but does not inherently prevent the weakness in production.

degrades

Physical and environmental threat protection directly addresses EM-FI risk through shielding and environmental controls.

mitigates

Equipment siting and protection can reduce exposure to EM sources but does not specifically target fault-injection vectors.

prevents

Secure development life cycle mandates initialization of resources before use.

prevents

Application security requirements can specify resource initialization checks.

prevents

Secure system architecture principles can include hardware-level countermeasures against EM-FI, though the control is not specific to this threat.

References