fix(core): fix boot_image_check__verified validation
What the developer wrote
Authored by tychovrahe
fix(core): fix boot_image_check__verified validation
[no changelog]
What changed, and why it matters
This commit adds a missing safety check in the Trezor hardware wallet's core firmware. Two functions that validate boot images now verify that the firmware actually has permission to read the image's memory before processing it. Without this check, a malformed or attacker-controlled image pointer could potentially be passed in, leading to unauthorized memory reads or a crash during the boot verification process. The fix is straightforward and defensive.
Treat this as a security-relevant hardening fix. Review whether other `*_verified` verifier functions perform equivalent `probe_read_access`/`probe_write_access` checks on nested pointer/size fields, and backport the fix to maintained firmware branches. Consider whether a CVE is warranted if the missing check could be reached from untrusted or less-privileged caller contexts.
Security signals we found
Missing access-control check on pointer/size pair before use
Addition of `probe_read_access()` guard in two verifier entry points
Functions named `*_verified` suggest they are security boundary validators
Patch is small, targeted, and purely additive (defensive hardening)
No changelog entry, but commit title explicitly frames it as a validation fix
Evidence from the diff
The patch adds a probe_read_access(image->image_ptr, image->image_size) check inside boot_image_check__verified() in both smcall_verifiers.c and syscall_verifiers.c. Previously, the function validated the boot_image_t structure pointer but not the image_ptr/image_size region it describes. This gap meant boot_image_check() could be called on memory the caller was not authorized to read. The fix ensures read access is proven before dereferencing/processing the image contents, mitigating a potential out-of-bounds or unauthorized read primitive in the secure-monitor and syscall verifier paths.
Changed components
core/embed/sys/smcall/stm32/smcall_verifiers.ccore/embed/sys/syscall/stm32/syscall_verifiers.cboot_image_check__verified() functionSecure monitor call (SMC) and syscall verifier subsystemsInspect captured patch +8 / −0
diff --git a/core/embed/sys/smcall/stm32/smcall_verifiers.c b/core/embed/sys/smcall/stm32/smcall_verifiers.c
index 40eda49d..23323520 100644
--- a/core/embed/sys/smcall/stm32/smcall_verifiers.c
+++ b/core/embed/sys/smcall/stm32/smcall_verifiers.c
@@ -65,6 +65,10 @@ bool boot_image_check__verified(const boot_image_t *image) {
goto access_violation;
}
+ if (!probe_read_access(image->image_ptr, image->image_size)) {
+ goto access_violation;
+ }
+
return boot_image_check(image);
access_violation:
diff --git a/core/embed/sys/syscall/stm32/syscall_verifiers.c b/core/embed/sys/syscall/stm32/syscall_verifiers.c
index e9524dd6..0d6a09b6 100644
--- a/core/embed/sys/syscall/stm32/syscall_verifiers.c
+++ b/core/embed/sys/syscall/stm32/syscall_verifiers.c
@@ -228,6 +228,10 @@ bool boot_image_check__verified(const boot_image_t *image) {
goto access_violation;
}
+ if (!probe_read_access(image->image_ptr, image->image_size)) {
+ goto access_violation;
+ }
+
return boot_image_check(image);
access_violation:
Why this scored 73/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.