CVE-2023-41097

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-208 CWE-327 CWE-203

Affected software

Vendor	Product	Versions
silabs.com	GSDK	< 4.4.0

References

https://github.com/SiliconLabs/gecko_sdk/releasesRelease Notes
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1Permissions Required
https://github.com/SiliconLabs/gecko_sdk/releasesRelease Notes
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1Permissions Required

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-410986.1An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon CVE-2023-410997.8In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM).CVE-2023-41106.1A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerabilit CVE-2023-411005.3An issue was discovered in the hcaptcha (aka hCaptcha for EXT:form) extension before 2.1.2 for TYPO3. It fails to check that the required ca CVE-2023-411019.8An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length CVE-2023-411027.5An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated CVE-2023-411035.4Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a JavaScript payload.CVE-2023-411046.5libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding,CVE-2023-411057.5An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be tru CVE-2023-411067.5An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in CVE-2023-411075.4TEF portal 2023-07-17 is vulnerable to a persistent cross site scripting (XSS)attack.CVE-2023-411088.8TEF portal 2023-07-17 is vulnerable to authenticated remote code execution.