CVE-2024-8361
Published: 07 January 2025
Summary
CVE-2024-8361 is a high-severity Incorrect Calculation of Buffer Size (CWE-131) vulnerability in Silabs (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 50.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-11 (Error Handling).
Deeper analysis
CVE-2024-8361 is a vulnerability in SiWx91x devices where the SHA2/224 algorithm incorrectly returns a hash of 256 bits instead of the expected 224 bits. This discrepancy triggers a software assertion, resulting in a Denial of Service (DoS) condition. The affected component is part of the cryptographic implementation in these Silicon Labs devices.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable over the network with low complexity, requiring no privileges or user interaction. A remote attacker can trigger the assertion by providing input that invokes the faulty SHA2/224 computation, causing the device to crash. If a watchdog timer is implemented, the device will restart after expiration; otherwise, recovery requires a hard reset. The issue is linked to CWE-131 (incorrect buffer size calculation) and CWE-617 (reachable assertion).
For mitigation details, refer to the Silicon Labs community advisory at https://community.silabs.com/068Vm00000I7zqo. The vulnerability was published on 2025-01-07.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49626
Vulnerability details
In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subsequently causes a Denial of Service (DoS). If a watchdog is implemented, device will restart…
more
after watch dog expires. If watchdog is not implemented, device can be recovered only after a hard reset
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote exploitation of crypto implementation flaw (wrong hash length) triggers assertion and device crash, directly mapping to application/system exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the cryptographic implementation flaw in SHA2/224 by requiring identification, reporting, and timely correction of vulnerabilities like CVE-2024-8361.
Protects system availability against the network-exploitable DoS triggered by the faulty SHA2/224 hash computation and assertion failure.
Ensures error handling for the incorrect 256-bit hash output does not compromise availability through exploitable assertions leading to crashes.