PT-2021-19448 · Shapeshift · Keepkey

Christian Reitter · Published 2021-05-06 · Updated 2022-05-03 · CVE-2021-31616

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShapeShift KeepKey hardware wallet firmware versions prior to 7.1.0

Description The issue is related to insufficient length checks in the firmware, allowing a stack buffer overflow via crafted messages. This overflow occurs in the ethereum extractThorchainSwapData() function in ethereum.c and can circumvent stack protections, leading to code execution. The vulnerable interface is reachable remotely over WebUSB.

Recommendations For versions prior to 7.1.0, update the firmware to version 7.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the ethereum extractThorchainSwapData() function until a patch is available. Restrict access to the WebUSB interface to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-31616

Affected Products

Keepkey

References · 8

• 🔥 https://blog.inhq.net/posts/keepkey-CVE-2021-31616 · Exploit
• https://github.com/keepkey/keepkey-firmware/commit/e49d45594002d4d3fbc1f03488e6dfc0a0a65836 · Patch
• https://shapeshift.com/library/keepkey-important-update-issued-april-4-required · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31616 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31616 · Security Note
• https://github.com/keepkey/keepkey-firmware/releases/tag/v7.1.0 · Note
• https://t.me/cvenotify/14525 · Telegram Post
• https://t.me/cvenotify/14182 · Telegram Post