Medium severity · published Feb 15, 2024
CVE-2024-0240
Silicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clients
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this results in all Bluetooth operations, such as advertising and scanning, to stop.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GS
GSDK · silabs.com
before 4.3.0 · source: vendor
GS
Gecko Software Development Kit · Silabs
before 4.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0240
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0240
Permissions Required
https://community.silabs.com/069Vm000001AjEfIAK
Product
https://github.com/SiliconLabs/gecko_sdk
More from GSDK
9.8
CVE-2023-4280
Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory region
9.1
CVE-2023-4020
Unvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memory
7.8
CVE-2023-3487
Integer overflow in Silicon Labs Gecko Bootloader leads to unbounded memory access
7.5
CVE-2024-22473
Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices
7.5
CVE-2023-6874
Zigbee Unauthenticated DoS via NWK Sequence number manipulation