Ledger Monero app spend key extraction (CVE-2020-6861)

Researchers Dušan Klinec and Miroslav Svitok showed that a malicious Monero client on the connected computer could extract the master Monero spend key from the Ledger Monero app 1.4.2. The device sends some intermediate values to the client encrypted with a key known only to the app; the researchers combined app commands into a decryption oracle and exploited a type confusion between scalars and curve points to recover the spend key.

According to the researchers, the attack needs a connected device with the PIN entered and the Monero app open, requires no confirmation by the user and leaves the display unchanged. Ledger’s bulletin LSB-008 (CVE-2020-6861) states that the flaw lies in the protocol between the device app and the Monero desktop client, so it affects both Nano S and Nano X users. LSB-008 also refers to an earlier, separate replay attack with the same outcome, published by Ledger as LSB-007 in October 2019.

Ledger states the fix in Monero app 1.5.1 removes the command used to build the oracle, adds strict state-machine checks, adds type tags to the HMACs that protect encrypted values, and requires the user to confirm the start of every transaction.

The researchers write that they reported the issue to Ledger on 3 January 2020, that Ledger acknowledged it on 11 January, and that Monero app 1.5.1 was released on 2 March 2020. They published their write-up on 25 April 2020 and were rewarded under Ledger’s bug bounty programme; Ledger’s bulletin is dated 27 April 2020.