What the developer wrote
Authored by benma's agent
Fix GroundedCell result lifetime
Read the confirmation result before clearing CONFIRM_STATE.
The result reference points into GroundedCell storage, so clearing the
state first invalidates it before result.is_ok() reads it.
This keeps the poll contract: publish the completed result, clear the task
state, and report completion. It also matches rust_workflow_unlock_poll().
What changed, and why it matters
This commit fixes a bug in the U2F confirmation workflow where the firmware could read a result from memory that had already been cleared, potentially giving an incorrect success/failure answer. The fix simply reads the result before wiping the state. It is a memory-use-order bug rather than an obvious exploit, but in a security device it could lead to wrong authorization decisions.
Review related poll functions for the same pattern; verify that GroundedCell-backed references are consumed before state reset; consider static analysis or Miri tests for lifetime issues in Rust/C FFI state machines.
Security signals we found
use-after-clear / stale reference in task state
incorrect result lifetime ordering
U2F confirmation workflow
potential incorrect authorization outcome
Evidence from the diff
In rust_workflow_confirm_poll(), CONFIRM_STATE was reset to TaskState::Nothing before result.is_ok() was evaluated. Because result is a reference into GroundedCell storage, clearing the state first invalidates the underlying data, making the subsequent is_ok() read potentially undefined or incorrect. The patch swaps the two statements so the result is consumed before the state is cleared, matching rust_workflow_unlock_poll().
Changed components
src/rust/bitbox02-rust-c/src/u2f_c_api.rsrust_workflow_confirm_poll()Inspect captured patch +1 / −1
diff --git a/src/rust/bitbox02-rust-c/src/u2f_c_api.rs b/src/rust/bitbox02-rust-c/src/u2f_c_api.rs
index 32c02fa..06e0ed7 100644
--- a/src/rust/bitbox02-rust-c/src/u2f_c_api.rs
+++ b/src/rust/bitbox02-rust-c/src/u2f_c_api.rs
@@ -181,8 +181,8 @@ pub unsafe extern "C" fn rust_workflow_confirm_poll(result_out: &mut bool) -> bo
unsafe {
match CONFIRM_STATE.get().as_ref().unwrap() {
TaskState::ResultAvailable(result) => {
- CONFIRM_STATE.get().write(TaskState::Nothing);
*result_out = result.is_ok();
+ CONFIRM_STATE.get().write(TaskState::Nothing);
true
}
TaskState::Running(_) => false,
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.