docs: add Maix Bit removal and Shannon calc fix to CHANGELOG
What the developer wrote
Authored by odudex
docs: add Maix Bit removal and Shannon calc fix to CHANGELOG
What changed, and why it matters
This commit is a documentation update to the project's changelog. It describes two security-related changes that were apparently made in earlier code: a heap buffer overflow in the camera-based entropy (randomness) module that could only be triggered on a discontinued device called the Maix Bit, and the removal of an unused deterministic random function from the firmware. The commit itself only edits the changelog text; it does not contain the actual code fixes.
Treat this as a changelog disclosure and locate the actual code commits that implemented the Shannon entropy fix and os.urandom() removal. Verify that the scratch buffer copy was indeed removed, that read lengths are capped to the buffer size and rounded to whole pixels, and that Maix Bit/CIF code paths are fully excised. Review whether any other devices or code paths could feed larger frames into the entropy module. Consider assigning a CVE if one has not already been requested.
Security signals we found
Heap buffer overflow in camera entropy / Shannon entropy module
Out-of-bounds write of 49,152 bytes on discontinued Maix Bit device
Removal of deterministic os.urandom() PRNG from firmware
Discontinuation/removal of Maix Bit device support and CIF code path
Evidence from the diff
The diff only modifies CHANGELOG.md. It adds a ‘Security Fixes’ entry describing a heap buffer overflow in the Shannon entropy module: a fixed 320x240 RGB565 scratch buffer (153,600 bytes) was used for all frames, but the Maix Bit’s CIF frames are 352x288 RGB565 (202,752 bytes), causing a 49,152-byte out-of-bounds write. The entry claims the scratch copy was removed, read length is now capped/rounded to whole pixels, and Maix Bit/CIF support was removed. A second note removes unused os.urandom() from MaixPy firmware because it was backed by a deterministic PRNG and could be mistaken for a secure entropy source. No source code changes are present in this commit, so the actual fixes must be verified in other commits.
Changed components
CHANGELOG.mdShannon entropy module (camera entropy)Maix Bit device support / CIF frame pathMaixPy firmware os.urandom()Inspect captured patch +7 / −0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d3727da..29f5542 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
# Changelog 26.05.0 - May 2025
+### Security Fixes
+- Camera entropy: fix a heap buffer overflow in the Shannon entropy module. Only the Maix Bit could trigger it, a device discontinued in 25.09.0 with no known users; every other device feeds the module a frame that fits. The module copied the whole frame into a fixed 320x240 RGB565 (153,600 byte) scratch buffer, so the Maix Bit's larger CIF frames (352x288 RGB565, 202,752 bytes) wrote 49,152 bytes past the end. The scratch copy has been removed entirely, the read length is now capped and rounded to whole pixels, and the CIF path is gone along with the Maix Bit
+
+### Removed Maix Bit Code
+All Maix Bit support has been removed from the source tree, including its firmware build project. Support for the device was discontinued in 25.09.0, which at the time kept the build parameters available; those are now gone too. The OV5642 sensor handling, used only by that device, was removed along with it.
+
### Stackbit 1248 Vertical Layout
Added vertical layout option for Stackbit 1248 backup display, allowing users to choose between Standard (horizontal) and Vertical (transposed) grid orientations.
@@ -7,6 +13,7 @@ Added vertical layout option for Stackbit 1248 backup display, allowing users to
Switch from the pure-Python urtypes and foundation-ur-py packages to the new uUR C module, allowing faster UR QR codes decoding with a smaller RAM footprint. Tests and the simulator now build the same module for CPython instead of shimming the pure-Python packages, so host and device run identical UR code.
### Other Bug Fixes and Improvements
+- Remove the unused `os.urandom()` from the MaixPy firmware. It was never called by Krux and played no part in generating keys or mnemonics, which draw entropy from the camera or dice. It was backed by a deterministic PRNG, so it has been removed to keep it from being mistaken for a secure source later
- Improve scan TinySeed and other binary visibility by drawing punches only
- Added `flash_success` method to standardize green success flashes across confirmation screens
- Update Embit to latest - 3ae0ef2
Why this scored 53/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.