chore(python): invalidate session even if EndSession call fails
What the developer wrote
Authored by matejcik
chore(python): invalidate session even if EndSession call fails
[no changelog]
What changed, and why it matters
This is a small hardening fix in the Python Trezor library. Previously, if the device failed to respond to an 'EndSession' command, the software might keep thinking the secure session was still usable. Now the session is marked invalid regardless of whether the EndSession call succeeds or fails. This reduces the chance of accidentally reusing or leaking a stale session, but the change is minor and defensive rather than a clear fix for an active attack.
Treat as a low-risk hardening improvement. Include in routine release notes and ensure downstream Python packages pick up the updated library. No urgent security response is warranted based on the diff alone.
Security signals we found
Session invalidation now occurs unconditionally on close
Exception path in EndSession previously skipped invalidation
Defensive hardening of session lifecycle in client library
Evidence from the diff
The patch moves self.is_invalid = True from inside the try block to a finally block in Session.close() in python/src/trezorlib/client.py. Before, an exception during messages.EndSession() would skip invalidation, leaving the local session object in a potentially usable state. After the change, the session is always invalidated locally even if the EndSession message fails. This is a session-lifecycle cleanup fix; it does not by itself demonstrate an exploitable vulnerability.
Changed components
python/src/trezorlib/client.pytrezorlib Session.close()trezorlib session managementInspect captured patch +2 / −1
diff --git a/python/src/trezorlib/client.py b/python/src/trezorlib/client.py
index dc7882b1..2a3b7ac0 100644
--- a/python/src/trezorlib/client.py
+++ b/python/src/trezorlib/client.py
@@ -134,9 +134,10 @@ class Session(t.Generic[ClientType, SessionIdType]):
LOG.info("Closing session %s", self)
try:
self.call(messages.EndSession())
- self.is_invalid = True
except Exception as e:
LOG.warning("Failed to end session: %s", e)
+ finally:
+ self.is_invalid = True
def cancel(self) -> None:
"""Send a Cancel signal to the device, interrupting the current workflow."""
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.