CVE-2023-27892 Memory corruption in n/a

Low 3.8 Published 2 May 2023 Updated 30 Jan 2025

Attackers with physical access to an unlocked KeepKey wallet can exploit buffer overflows to extract the BIP39 mnemonic or crash the device.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-27892?

CVE-2023-27892 is a low-severity memory corruption vulnerability in n/a, published on 2 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet.

Weakness: CWE-125, CWE-120

Which versions are affected by CVE-2023-27892?

It affects 1 product.

Products include Shapeshift Keepkey Firmware.

How do I fix CVE-2023-27892?

No fix has been published for CVE-2023-27892 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-27892 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27892 exists.

Sources

Also known as GHSA-76qj-23pr-3333.