fix(core): fix integer overflow in storage
What the developer wrote
Authored by tychovrahe
fix(core): fix integer overflow in storage
[no changelog]
What changed, and why it matters
This commit fixes a potential integer overflow in the Trezor hardware wallet's storage code. A variable that holds a flash memory offset was declared as a 16-bit unsigned integer (uint16_t), which could overflow if the sector offset plus the amount of data already written exceeds 65,535. The fix widens that variable to a 32-bit unsigned integer (uint32_t), giving it enough room for larger flash addresses. If exploited, this kind of overflow could corrupt where data is written in the device's storage, potentially leading to data loss or unexpected behavior.
Treat this as a security-relevant bug fix. Review whether the overflow is reachable through normal or attacker-controlled storage operations, and assess whether any wrong-offset write could be triggered from untrusted host input. Consider requesting a CVE if the issue is reachable and could affect device integrity or confidentiality. Ensure the fix is included in the next firmware release.
Security signals we found
Integer overflow in flash offset calculation
Wrong-size variable for physical storage address
Potential flash write to incorrect location
Storage subsystem fix in security-critical firmware
Evidence from the diff
In storage/norcow_blockwise.h, norcow_update_bytes() computes flash_offset as sector_offset + norcow_write_buffer_flashed. Both operands are uint16_t, and the result was stored in a uint16_t. On platforms where int is 32-bit, the addition is performed in int and then truncated back to uint16_t during assignment. If the true offset exceeds UINT16_MAX, the stored value wraps modulo 65536. The variable is later used as a flash write destination, so an overflow could cause writes to the wrong physical location. The patch changes flash_offset to uint32_t, preserving the full computed offset.
Changed components
storage/norcow_blockwise.hnorcow_update_bytes() functionTrezor Core flash/storage subsystemInspect captured patch +1 / −1
diff --git a/storage/norcow_blockwise.h b/storage/norcow_blockwise.h
index 8ddee0f9..b06fd7f6 100644
--- a/storage/norcow_blockwise.h
+++ b/storage/norcow_blockwise.h
@@ -274,7 +274,7 @@ secbool norcow_update_bytes(const uint16_t key, const uint8_t *data,
}
uint16_t tmp_len = len;
- uint16_t flash_offset = sector_offset + norcow_write_buffer_flashed;
+ uint32_t flash_offset = sector_offset + norcow_write_buffer_flashed;
ensure(flash_unlock_write(), NULL);
while (tmp_len > 0) {
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.