Two Ledger Bugs Needed Fixing After Viral 'Hack' Was Patched

Crypto hardware-wallet maker Ledger released Ethereum app version 1.22.3 on Aug. 25 to fix two signing vulnerabilities that remained in its previous security update. The update addresses flaws that could hide operations from a device review or substitute a token approval for an expected payment.

The release follows a separate controversy over an Ethereum signing flaw reproduced by rival wallet maker OneKey. That issue, tracked as LSB-023, affected older versions and allowed a compromised host to interleave commands so transaction parameters could change after being displayed but before signing. Ledger said OneKey demonstrated the bug against version 1.22.1 after the company had already fixed it in Ethereum app 1.22.2, released Aug. 13.

"No Ledger user was hacked," Ledger's security team said, describing the demonstration as a laboratory reproduction involving outdated software. The company said it had found no evidence of exploitation in the wild. Ledger Chief Technology Officer Charles Guillemet made the same distinction, saying reproducing an already-patched flaw did not amount to "hacking Ledger."

Version 1.22.2, however, did not close every known Ethereum-app vulnerability on Ledger. Two separate flaws, LSB-024 and LSB-025, remained until the release of 1.22.3.

LSB-024 affected how the Ethereum app processed arrays of operations during clear signing. The app read the number of operations using a 16-bit value but stored the remaining count in an 8-bit field. In Ledger's proof of concept, an array containing 257 operations wrapped the counter back to one, causing the device to display only the final operation even though its signature authorized the entire batch. Exploitation required a compromised host and an unusually large attacker-controlled operation array. Ledger tested the scenario on a private network fork and reported no real-user losses.