CVE-2021-31616 - Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a s

CVE-2021-31616

Summary

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB.

References

https://github.com/keepkey/keepkey-firmware/commit/e49d45594002d4d3fbc1f03488e6dfc0a0a65836
https://github.com/keepkey/keepkey-firmware/releases/tag/v7.1.0
https://blog.inhq.net/posts/keepkey-CVE-2021-31616/
https://shapeshift.com/library/keepkey-important-update-issued-april-4-required

Vulnerable Configurations

cpe:2.3:o:shapeshift:keepkey_firmware:7.0.3:*:*:*:*:*:*:*
cpe:2.3:o:shapeshift:keepkey_firmware:7.0.3:*:*:*:*:*:*:*
cpe:2.3:h:shapeshift:keepkey:-:*:*:*:*:*:*:*
cpe:2.3:h:shapeshift:keepkey:-:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 03-05-2022 - 16:04)
Impact:
Exploitability:

CWE

CWE-787

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

Last major update

03-05-2022 - 16:04

Published

06-05-2021 - 13:15

Last modified

03-05-2022 - 16:04