title: Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices
description: TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.
problem types: CWE-908 Use of Uninitialized Resource
affected:
{
defaultStatus: affected
platforms: ARM
product: GSDK
repo: https://github.com/SiliconLabs/gecko_sdk/releases
vendor: silabs.com
versions:
lessThanOrEqual: 4.4.0, status: affected, version: 0, versionType: 4.4.x and earlier
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL