What the developer wrote
Authored by Peter D. Gray
bug note
What changed, and why it matters
A developer added a comment in the COLDCARD MK4 bootloader code flagging that a function reads a configuration byte from a secure chip but does not check whether the read operation failed. If the read fails, the function could return an uninitialized or garbage value. This is a code-quality and potential security issue, but the patch only adds a comment—it does not fix the bug.
Treat this as a bug ticket marker. Audit all callers of ae_read_config_byte() to determine whether an unchecked failure can lead to incorrect configuration decisions, bypass of security checks, or boot of an untrusted firmware. Then modify ae_read_config_byte() to propagate or handle ae_read_config_word() failures rather than returning unvalidated data.
Security signals we found
Unchecked return value from security-critical hardware read
Possible use of uninitialized stack memory if read fails
Located in bootloader code interacting with secure element
Patch is documentation-only; vulnerability not remediated
Evidence from the diff
In stm32/mk4-bootloader/ae.c, ae_read_config_byte() calls ae_read_config_word(offset, tmp) to populate a 4-byte local buffer, then returns tmp[offset % 4]. The newly added comment notes that the return value of ae_read_config_word() is not checked. If that function fails (for example, due to a communication error with the ATECC608 secure element), tmp remains uninitialized stack data, and an uninitiated/config byte is returned to callers. The commit does not implement error handling.
Changed components
stm32/mk4-bootloader/ae.cae_read_config_byte() functionATECC608 secure element configuration readsInspect captured patch +1 / −0
diff --git a/stm32/mk4-bootloader/ae.c b/stm32/mk4-bootloader/ae.c
index a55e34c..df632ed 100644
--- a/stm32/mk4-bootloader/ae.c
+++ b/stm32/mk4-bootloader/ae.c
@@ -1726,6 +1726,7 @@ ae_read_config_byte(int offset)
uint8_t tmp[4];
ae_read_config_word(offset, tmp);
+ // BUG: didnt check for failure, in which case we will return un-inited values
return tmp[offset % 4];
}
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.