What the developer wrote
Authored by willwang
modified device info
What changed, and why it matters
This commit removes a UI button that displayed the device's public key (labeled as device UID) from the 'About' info screen of a Keystone hardware wallet. It is a user-interface change, not a fix for a code vulnerability. The change reduces information exposure through the screen but does not alter any cryptographic or security logic.
No immediate security action required. Treat as a routine UI/privacy change. If the device UID was considered sensitive, verify that no other screens, logs, or exported data still expose it without user consent.
Security signals we found
UI element exposing device public key/UID removed
No cryptographic, authentication, or access-control changes
No buffer, pointer, or input-validation changes
No incident or vulnerability disclosure referenced
Evidence from the diff
The patch deletes the creation and alignment of a button that opened g_DevicePublicKeyView via OpenViewHandler in GuiAboutInfoEntranceWidget. The remaining UI elements are re-aligned to fill the gap. No security-critical code paths, key handling, or access controls are modified. The removed button exposed the device public key/UID in the UI; its removal is a privacy/information-disclosure reduction, not an exploitability fix.
Changed components
src/ui/gui_widgets/gui_about_info_widgets.cAbout info screen UIDevice public key / UID view buttonInspect captured patch +1 / −13
diff --git a/src/ui/gui_widgets/gui_about_info_widgets.c b/src/ui/gui_widgets/gui_about_info_widgets.c
index 1727d3c..9addaa6 100644
--- a/src/ui/gui_widgets/gui_about_info_widgets.c
+++ b/src/ui/gui_widgets/gui_about_info_widgets.c
@@ -181,18 +181,6 @@ void GuiAboutInfoEntranceWidget(lv_obj_t *parent)
table[1].position.y = 0;
button = GuiCreateButton(parent, 456, 84, table, NUMBER_OF_ARRAYS(table) - 1,
LogExportHandler, NULL);
- lv_obj_align(button, LV_ALIGN_DEFAULT, 12, 383);
-
- titleLabel = GuiCreateTextLabel(parent, _("about_info_device_uid"));
- imgArrow = GuiCreateImg(parent, &imgArrowRight);
-
- table[0].obj = titleLabel;
- table[1].obj = imgArrow;
- table[1].align = LV_ALIGN_RIGHT_MID;
- table[1].position.x = -24;
- table[1].position.y = 0;
- button = GuiCreateButton(parent, 456, 84, table, NUMBER_OF_ARRAYS(table) - 1,
- OpenViewHandler, &g_DevicePublicKeyView);
lv_obj_align(button, LV_ALIGN_DEFAULT, 12, 282);
uint16_t height = 82;
@@ -219,7 +207,7 @@ void GuiAboutInfoEntranceWidget(lv_obj_t *parent)
table[1].position.y = -24;
button = GuiCreateButton(parent, 456, height, table, NUMBER_OF_ARRAYS(table) - 1,
NULL, NULL);
- lv_obj_align(button, LV_ALIGN_DEFAULT, 12, 484);
+ lv_obj_align(button, LV_ALIGN_DEFAULT, 12, 383);
line = GuiCreateDividerLine(parent);
lv_obj_align(line, LV_ALIGN_DEFAULT, 0, 484 + height + 12);
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.