Skip to main content

Insufficient Entropy

CVE-2024-22473

Medium
6.8/10

Summary

TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.

  • HIGH
  • NETWORK
  • HIGH
  • CHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-331 - Insufficient Entropy

The software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References

Advisory Timeline

  • Published