Ledger Ethereum App 1.22.3 Patches Two Signing Flaws
Ledger discloses two additional Ethereum-app signing bugs fixed in version 1.22.3 after the prior patch left them open.
Ledger released Ethereum app 1.22.3 on Aug 25, closing LSB-024 (array-count wrap in clear signing) and LSB-025 (swap-provider token-approval substitution).
LSB-024 allowed a 257-operation array to display only the final operation while authorizing the full batch; required compromised host and large attacker array.
LSB-025 allowed a swap provider to substitute a token approval for a payment request; limited to matching parameters and required a follow-on transaction.
Ledger states no evidence of exploitation in the wild for either flaw.
Users must update the Ethereum app via Ledger Live; firmware update alone does not replace the app.