Ledger users should update the Ethereum app to version 1.22.2 after official code changes showed that a malicious dApp or other connected host could start a second signing command while a transaction was still under review.
In the path described by security company TestMachine, pressing approve could return a signature for substituted data instead of the transaction shown on the device.
TestMachine said on Aug. 22 that the attack required a dApp with WebHID access. The group said a second command could replace the transaction held in memory without opening a new review, leaving the original details on screen while the device signed the replacement.
It said the behavior was validated on Ledger Flex.
Ledger’s code history shows one official fix commit saying new signing commands could tear down an active review before returning an error. Another added state checks because approval callbacks previously signed without confirming that the app remained in the expected signing state.
Version 1.22.2 closes that documented path by refusing a new signing session during an active review and rejecting an approval callback when the state no longer matches. The reviewed sources establish a code-level fix for those entry and callback defects.
TestMachine asserted that shared code extended the issue to Nano X, Nano S Plus, Stax, and Apex, and the tagged app manifest lists those models alongside Flex as build targets.
Ledger’s release comparison starts from version 1.22.1, while the earliest affected app release remains undisclosed.
Ledger’s changelog dates 1.22.2 to Aug. 12, GitHub shows the signed tag on Aug. 13, and TestMachine said on Aug. 22 that the fix was not yet released.
Ledger CTO Charles Guillemet said on Aug. 23 that Ledger Donjon had found a bug in “certain clear signing flows” and deployed the fix about two weeks earlier. The sources leave open whether TestMachine was referring to distribution through Ledger Wallet.
Guillemet said Donjon found the bug before TestMachine contacted Ledger’s bounty program, while TestMachine said its Azimuth system found the issue and that it shared and verified the finding with Ledger.
Users should confirm that Ethereum app 1.22.2 is installed. Guillemet also advised keeping device firmware, apps, and client software current, although the public sources give no firmware minimum specific to this flaw.
They report no confirmed in-the-wild exploitation, lost funds, or private-key extraction.
The issue is separate from the native Zilliqa Ledger app flaw involving Schnorr nonce leakage and the 2023 Connect Kit compromise, which involved a malicious JavaScript library and reported losses.
Be the first to comment