SatoshiLabs Trezor One up to 1.8.1 OLED Display information disclosure

Summaryinfo

A vulnerability was found in SatoshiLabs Trezor One up to 1.8.1. It has been rated as problematic. This affects an unknown part of the component OLED Display. Performing a manipulation results in information disclosure. This vulnerability was named CVE-2019-14353. The attack may be carried out on the physical device. There is no available exploit. This vulnerability has a historic impact because of its background and how it was received. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in SatoshiLabs Trezor One up to 1.8.1. It has been classified as problematic. This affects an unknown function of the component OLED Display. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: this CVE applies exclusively to the Trezor One, and does not refer to any issues with OLED displays on other devices.

The weakness was presented 08/08/2019. This vulnerability is uniquely identified as CVE-2019-14353 since 07/28/2019. The exploitability is told to be difficult. An attack has to be approached locally. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/21/2023). MITRE ATT&CK project uses the attack technique T1592 for this issue. Due to its background and reception, this vulnerability has a historic impact.

Upgrading to version 1.8.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• SatoshiLabs

Name

• Trezor One

Version

• 1.8.0
• 1.8.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion