Ledger công bố lỗ hổng LSB 023: Các tham số được hiển thị có thể khác với các tham số đã ký

The Huoxing Finance report states that on August 28, Ledger disclosed details of the LSB 023 security vulnerability on its official website. Applications built on the Ledger Secure SDK may still receive new APDU commands during user screen confirmation, resulting in a discrepancy between the parameters displayed on the screen and the final signing parameters. Under conditions where an attacker controls the APDU communication between the device and host, the device may generate a signature for different parameters after the user confirms the operation shown on the screen. Ledger stated that the issue has been resolved via application-level validation and SDK-layer fixes, and released Ledger Secure SDK v26.6.1 on August 21; related applications have been rebuilt and re-released. Users must update their applications via Ledger Live, as updating only the device firmware is insufficient to complete the fix. However, Ledger noted there is currently no evidence that this vulnerability has been exploited in practice.