title: Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffer
description:
Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (delivered as part of Silicon Labs Gecko SDK v4.4.0) which may enable attackers to trigger a bus fault and crash of the device, requiring a reboot in order to rejoin the network.
problem types: CWE-770 Allocation of Resources Without Limits or Throttling
affected:
{
defaultStatus: affected
packageName: Gecko SDK
platforms: [ARM, 32 bit]
product: Ember ZNet SDK
repo: https://github.com/SiliconLabs/gecko_sdk/releases
vendor: silabs.com
versions:
lessThan: 7.4.0.0, status: unaffected, version: 0, versionType: 7.4.x
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL