Vulnerabilities > CVE-2019-14354 - Information Exposure Through Discrepancy vulnerability in Ledger Nano S Firmware and Nano X Firmware

047910
CVSS 2.4 - LOW
Attack vector
PHYSICAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
LOW
Integrity impact
NONE
Availability impact
NONE
low complexity
ledger
CWE-203

Summary

On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.

Vulnerable Configurations

Part Description Count
OS
Ledger
2
Hardware
Ledger
2

Common Weakness Enumeration (CWE)