bugfix: reject invalid highwater values
What the developer wrote
Authored by scgbckbone
bugfix: reject invalid highwater values
What changed, and why it matters
This commit fixes a small but meaningful bug in the COLDCARD bootloader. Two separate code paths that check firmware update data were missing the word 'else', so after rejecting bad data they would also run a second check. That second check could trigger an internal assertion (a hard crash/reboot) when given an invalid 'highwater' timestamp value, instead of cleanly rejecting the bad update. The fix makes the bootloader properly reject invalid values without crashing.
Treat as a security fix and include in the next release. Users should update bootloader/firmware once the release is available. No immediate independent CVE action is required unless further analysis shows the assertion can be escalated beyond a denial-of-service.
Security signals we found
CWE-670: Always-Incorrect Control Flow Implementation (missing else branch)
CWE-617: Reachable Assertion (bootloader assertion triggered by invalid input)
Denial-of-service vector: malformed firmware update can crash/reboot bootloader
ChangeLog explicitly labels the change as a security-relevant bugfix
Evidence from the diff
In both stm32/bootloader/dispatch.c and stm32/mk4-bootloader/dispatch.c, the firewall_dispatch() handler for a firmware-update method validates buf_io[0] and sets rv = ERANGE if it is out of range. Previously, the next condition was a separate ‘if (check_is_downgrade(…))’ rather than ‘else if’, so execution continued into check_is_downgrade() even after the range check failed. check_is_downgrade() appears to assert or fail on invalid highwater timestamps, causing a bootloader assertion rather than returning the ERANGE error. The change adds ‘else’ so that the downgrade check is skipped when the range check already failed, turning a potential assertion/DoS into a clean error return.
Changed components
stm32/bootloader/dispatch.cstm32/mk4-bootloader/dispatch.cCOLDCARD bootloader firmware-update dispatch pathInspect captured patch +4 / −2
### releases/Next-ChangeLog.md
@@ -39,6 +39,8 @@ This lists the new changes that have not yet been published in a normal release.
- Bugfix: Prevent valid message signatures when using a Delta Mode PIN.
- Bugfix: Harden callgate buffer validation against integer overflow and out-of-range access,
following a finding in the [Karma-X security review](https://karma-x.io/blog/post/75/).
+- Bugfix: Reject out-of-range firmware highwater timestamps without triggering a
+ bootloader assertion.
- Bugfix: USB `dwld` allowed readback of arbitrary staged PSRAM content (uploaded
PSBT, multisig enroll file), also across sessions and over plaintext links.
Downloads are now limited to the single most recent result produced for
### stm32/bootloader/dispatch.c
@@ -681,7 +681,7 @@ firewall_dispatch(int method_num, uint8_t *buf_io, int len_in,
if(buf_io[0] < 0x10 || buf_io[0] >= 0x40) {
// bad data
rv = ERANGE;
- } if(check_is_downgrade(buf_io, NULL)) {
+ } else if(check_is_downgrade(buf_io, NULL)) {
// already at a higher version?
rv = EAGAIN;
} else {
### stm32/mk4-bootloader/dispatch.c
@@ -466,7 +466,7 @@ firewall_dispatch(int method_num, uint8_t *buf_io, int len_in,
if(buf_io[0] < 0x10 || buf_io[0] >= 0x40) {
// bad data
rv = ERANGE;
- } if(check_is_downgrade(buf_io, NULL)) {
+ } else if(check_is_downgrade(buf_io, NULL)) {
// already at a higher version?
rv = EAGAIN;
} else {Why this scored 43/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.