Skip to content

Release v7.1.7

Choose a tag to compare
@mrnerdhair mrnerdhair released this 13 Jul 18:33
· 294 commits to master since this release

(This release supersedes v7.1.5; it is identical except for the fix for #281. We skipped v7.1.6 as #283 affected that particular build artifact.)

New Features

Bug Fixes / Other Changes

  • Updated certain upstream dependencies (specifically trezor-crypto and nanopb)
  • Fix canDropPrivs() change breaking unofficial firmware builds (fixes #281) (0834dd8)

Security Improvements

  • Stricter checks when performing certain string and pointer operations (7263d78, cc35343, 7d6bfe0, 772d47c)

    These checks are incremental security enhancements which improve KeepKey's resistance against certain types of theoretical attacks.

  • Improvements to the tamper-resistance of canDropPrivs() (1ee165c, 0527170)

    This is a mitigation for a potential electrical glitching attack disclosed to us by Christian Reitter. This attack requires sophisticated tools and physical possession of your KeepKey, and we have no evidence that it has ever occurred outside of a laboratory setting. Please refer to our published advisory for more information.