Integer Parsing Vulnerability in Ledger Live by Ledger

CVE-2023-7345

What is CVE-2023-7345?

Ledger Live, the proprietary cryptocurrency management software by Ledger, suffers from an integer parsing vulnerability in versions prior to 6.34.7. This flaw occurs in the generation of EIP-712 typed data messages, where incorrect handling of hexadecimal field parsing in scenarios involving odd-length values can lead to exploitation. Attackers can leverage this vulnerability to manipulate message values, enabling the signing of truncated or misinterpreted data. Such unauthorized signatures may result in unintended blockchain transactions, including asset transfers that could compromise user funds.

References