CVE-2023-4280

The TrustZone implementation in Gecko SDK does not properly validate input data passed from the untrusted execution area (Normal World) to the trusted area (Secure World). Out-of-bounds read (CWE-125) and out-of-bounds write (CWE-787) errors indicate that an attacker can pass specially crafted input data causing reads or writes outside the designated buffers. As a result, it is possible to cross the TrustZone isolation boundary and gain access to protected memory without required permissions.

An attacker can read or modify the contents of a trusted memory region, which may lead to disclosure of sensitive data (e.g., cryptographic keys), privilege escalation, or compromise of system integrity and availability.

Update Gecko SDK to a version higher than 4.3.x according to manufacturer recommendations available at https://community.silabs.com/069Vm0000004NinIAE. Apply patches available from the manufacturer according to the references.

Silicon Labs Gecko Software Development Kit (Gecko SDK) version 4.3.x and earlier, covering devices utilizing TrustZone implementation.