CVE-2023-7345

Vulnerability

A integer parsing vulnerability exists in the ledgerhq/hw-app-eth library used by Ledger Live when handling EIP-712 typed data messages. The flaw occurs when a hexadecimal integer field contains an odd number of characters, causing the value to be truncated (e.g., 0x123 becomes 0x12). This affects versions of ledgerhq/hw-app-eth prior to 6.34.7 and Ledger Live prior to 2.70.0 [1][2].

Exploitation

An attacker can craft a malicious EIP-712 message with an integer field containing an odd-length hex string. A victim using a vulnerable version of Ledger Live with a Ledger device must be tricked into signing the message (user interaction required). When the victim signs, the resulting signature applies to the truncated value rather than the intended one [1].

Impact

Successful exploitation allows the attacker to obtain a valid signature on a manipulated message. This signature can be used to authorize unintended blockchain transactions, such as transferring assets at incorrect amounts, potentially leading to financial loss [1][2].

Mitigation

The vulnerability is fixed in ledgerhq/hw-app-eth version 6.34.7, which is included in Ledger Live 2.70.0. Users should update to these versions to mitigate the issue [1]. No workarounds have been disclosed.