CVE-2021-31616

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages

published May 6, 2021

CVSS
—
EPSS
2%
Percentile
84.6
In the wild
Unconfirmed
What it is

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02497 · 84.6th percentile
Published
2021-05-06T11:01Z
EPSS history
Timeline
  • 06 MAY 11:01Z
    Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages
    cvelistv5