Restore borrowed secret handling in SensitiveValues
What the developer wrote
Authored by scgbckbone
Restore borrowed secret handling in SensitiveValues
What changed, and why it matters
This commit removes one line of code that was adding a secret value to an internal tracking list called 'spots' inside the COLDCARD firmware's sensitive-data handling. The title says it 'restores borrowed secret handling,' suggesting the previous code accidentally treated a borrowed/short-lived secret as something that needed to be tracked for later cleanup. The change is tiny and defensive, but the commit message alone does not explain whether any actual security bug resulted from the removed line.
Treat as a low-confidence hardening/correctness fix. Review the full history around this line to confirm whether the original addition caused any observable security issue, memory corruption, or secret leak. If a security bug existed, request a CVE and vendor advisory from Coinkite.
Security signals we found
Removal of sensitive-value tracking registration
Change touches secret-handling / stash code
Commit title frames change as restoring correct borrowed-secret semantics
Single-line deletion in a security-critical module
Evidence from the diff
In shared/stash.py, the SensitiveValues class decodes a secret. When the secret is supplied directly (the ‘else’ branch is not taken), the code previously appended self.secret to self.spots. The patch deletes that append. ‘spots’ appears to be a list of memory references/addresses that the firmware later overwrites to clear sensitive data. By appending a borrowed secret, the code may have been marking memory it did not own for overwrite, or keeping a reference alive longer than intended. The fix restores the intended behavior where borrowed secrets are not registered in the cleanup list. No CVE, advisory, or vendor security statement is supplied.
Changed components
shared/stash.pySensitiveValues classSecretStash.decode path for externally-supplied secretsInspect captured patch +0 / −1
diff --git a/shared/stash.py b/shared/stash.py
index 80ef64c..9f28e2c 100644
--- a/shared/stash.py
+++ b/shared/stash.py
@@ -215,7 +215,6 @@ class SensitiveValues:
self.deltamode = False
self.mode, self.raw, self.node = SecretStash.decode(self.secret, self._bip39pw)
- self.spots.append(self.secret)
else:
# More typical: fetch the secret from bootloader and SE
# - but that's real slow, so avoid if possible
Why this scored 55/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.