Ledger Live and hw-app-eth Integer Parsing Vulnerability in EIP-712 Message Handling

An integer parsing vulnerability has been identified in Ledger Live versions prior to 2.70.0, specifically within the ledgerhq/hw-app-eth package in versions prior to 6.34.7. This vulnerability allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect parsing of hexadecimal fields when values have an odd number of characters. As a result, attackers can obtain signatures on truncated or misinterpreted message values, leading to unauthorized blockchain transactions, such as asset transfers for incorrect amounts.

Impact

Exploitation of this vulnerability could result in unauthorized blockchain transactions, allowing for asset transfers at incorrect amounts.