The initialization vector (IV) used by the secure... · CVE-2023-2747 · GitHub Advisory Database · GitHub

The initialization vector (IV) used by the secure...

Moderate severity Unreviewed Published Jun 15, 2023 to the GitHub Advisory Database • Updated Sep 27, 2024

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized.

References

Published by the National Vulnerability Database

Jun 15, 2023

Published to the GitHub Advisory Database Jun 15, 2023

Last updated Sep 27, 2024

Weaknesses

CWE-908

Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized. Learn more on MITRE.

CWE-1204

Generation of Weak Initialization Vector (IV)

The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive. Learn more on MITRE.