fix(core): fix device_menu crash on devices without a serial number
What the developer wrote
Authored by cepetr
fix(core): fix device_menu crash on devices without a serial number
[no changelog]
What changed, and why it matters
This commit fixes a crash in the Trezor device's on-screen 'About device' menu when the device lacks a serial number. It wraps the serial-number lookup in a try/except block and displays 'N/A' instead of crashing. There is no indication this can be exploited by an attacker; it is a robustness fix for a user-interface screen.
Treat as a minor stability fix. No urgent security response is warranted. If a changelog is maintained, consider adding a note about improved robustness for unprovisioned devices.
Security signals we found
Crash/DoS in local UI flow (device menu) on unprovisioned hardware
Defensive exception handling added to prevent task failure
No input from untrusted sources is processed
Evidence from the diff
In core/src/apps/homescreen/device_menu.py, the code previously called utils.serial_number() unconditionally when USE_SERIAL_NUMBER was enabled. On unprovisioned devices this raises RuntimeError, crashing the device menu task. The patch catches RuntimeError and sets serial_no to ‘N/A’, allowing the menu to render. The crash is local to the UI flow and does not appear to expose secrets, bypass authentication, or affect transaction signing.
Changed components
core/src/apps/homescreen/device_menu.pyTrezor Safe hardware devices without a programmed serial numberInspect captured patch +6 / −1
diff --git a/core/src/apps/homescreen/device_menu.py b/core/src/apps/homescreen/device_menu.py
index f7a2fbed..28491d41 100644
--- a/core/src/apps/homescreen/device_menu.py
+++ b/core/src/apps/homescreen/device_menu.py
@@ -117,7 +117,12 @@ async def handle_device_menu() -> None:
firmware_type = "Bitcoin-only" if utils.BITCOIN_ONLY else "Universal"
production_year = _get_production_year()
- serial_no = utils.serial_number() if utils.USE_SERIAL_NUMBER else None
+
+ try:
+ serial_no = utils.serial_number() if utils.USE_SERIAL_NUMBER else None
+ except RuntimeError:
+ # Unprovisioned devices might not have a serial number
+ serial_no = "N/A"
about_items: list[tuple[str | None, str | None, bool]] = [
(TR.homescreen__firmware_version, firmware_version, False),
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.