CVE-2019-18671

Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages. The vulnerability could allow code execution or other forms of impact. It can be triggered by unauthenticated attackers and the interface is reachable via WebUSB.

CVSS v3.0 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3.0 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba615082d309d80c3	Patch Third Party Advisory
https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3	Third Party Advisory
https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065	Release Notes Third Party Advisory
https://blog.inhq.net/posts/keepkey-CVE-2019-18671/

Advertisement

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:keepkey:keepkey_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:keepkey:keepkey:-:*:*:*:*:*:*:*

Information

Published : 2019-12-06 10:15

Updated : 2020-02-11 19:15

NVD link : CVE-2019-18671

Mitre link : CVE-2019-18671

JSON object : View

CWE

CWE-787

Out-of-bounds Write

Advertisement

Products Affected

keepkey

keepkey_firmware
keepkey

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba615082d309d80c3", "name": "https://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba615082d309d80c3", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3", "name": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065", "name": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065", "tags": ["Release Notes", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://blog.inhq.net/posts/keepkey-CVE-2019-18671/", "name": "https://blog.inhq.net/posts/keepkey-CVE-2019-18671/", "tags": [], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages. The vulnerability could allow code execution or other forms of impact. It can be triggered by unauthenticated attackers and the interface is reachable via WebUSB."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-787"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-18671", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2019-12-06T18:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:keepkey:keepkey_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.2.2"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:keepkey:keepkey:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-02-12T03:15Z"}