What the developer wrote
Authored by cepetr
fix(core): fix applet mpu reconfig
[no changelog]
What changed, and why it matters
This commit fixes a bug in how the Trezor hardware wallet's memory protection unit (MPU) is reconfigured when switching to or from a small helper program ('applet'). Previously, the code could read from a NULL pointer and store an invalid value, which might weaken memory isolation between the main firmware and the applet. The fix ensures the applet layout pointer is checked before use and the TLS (thread-local storage) area is safely zeroed when no applet is active.
Treat as a security-relevant hardening fix. Review whether the vulnerable path was reachable from untrusted applet code or applet-loading logic, and consider whether a security advisory or firmware update is warranted for affected STM32U5 devices. No independent researcher attribution is present in the commit, so no credit attribution is needed unless disclosed elsewhere.
Security signals we found
NULL pointer dereference risk in MPU applet reconfiguration
Memory protection unit (MPU) region configuration change
Applet isolation boundary (main firmware vs. applet)
TLS area stored from potentially invalid layout pointer
Fix is STM32U5-specific embedded security code
Evidence from the diff
In mpu_set_active_applet(), the original code dereferenced layout->tls before checking whether layout was NULL, then later repeated the assignment after the NULL check. The patch removes the unconditional assignment and replaces the later one with a NULL-safe ternary that zero-initializes drv->app_tls when layout is NULL. This prevents a potential NULL pointer dereference / use of uninitialized or attacker-influenced memory during MPU applet reconfiguration on STM32U5 builds.
Changed components
core/embed/sys/mpu/stm32u5/mpu.cmpu_set_active_applet()STM32U5 MPU driverApplet memory isolation / TLS region #7Inspect captured patch +1 / −3
diff --git a/core/embed/sys/mpu/stm32u5/mpu.c b/core/embed/sys/mpu/stm32u5/mpu.c
index 69f38a623..ef7cfc9ea 100644
--- a/core/embed/sys/mpu/stm32u5/mpu.c
+++ b/core/embed/sys/mpu/stm32u5/mpu.c
@@ -343,8 +343,6 @@ void mpu_set_active_applet(const applet_layout_t* layout) {
mpu_disable();
- drv->app_tls = layout->tls;
-
if (layout != NULL) {
// clang-format off
if (layout->code1.start != 0 && layout->code1.size != 0) {
@@ -384,7 +382,7 @@ void mpu_set_active_applet(const applet_layout_t* layout) {
// Remember the TLS area of the active applet
// (used in region #7 in MPU_APP mode)
- drv->app_tls = layout->tls;
+ drv->app_tls = layout ? layout->tls : (mpu_area_t){0};
mpu_update_region7(drv->mode);
Why this scored 57/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.