fix(core): fix crash when setting wipe code
What the developer wrote
Authored by tychovrahe
fix(core): fix crash when setting wipe code
[no changelog]
(cherry picked from commit da76bd501dd1bfefba472a969f213253ac6fc7cf)
What changed, and why it matters
This commit fixes a crash that could occur when setting or changing the Trezor device's wipe code. The fix moves a memory-protection reconfiguration call to happen before user-interface progress is initialized. The crash appears to be a reliability bug rather than a security vulnerability that an attacker could exploit to steal funds or bypass protections.
Treat as a stability/reliability fix. Include in firmware release notes as a bug fix. No urgent security response is indicated unless further analysis shows the crash is reproducible by an attacker to deny service or corrupt storage state.
Security signals we found
Memory protection unit (MPU) configuration ordering change
Crash fix in wipe-code/PIN management code path
No explicit security claim or CVE in commit message
Evidence from the diff
In storage/storage.c, storage_change_wipe_code() previously called ui_progress_init() before mpu_reconfig(MPU_MODE_STORAGE). The patch swaps the order so the MPU is reconfigured into storage mode before any UI progress or unlock operations. The crash likely stemmed from memory access permissions: UI/progress code running while the MPU was not yet in the expected storage mode could trigger a fault. The change is minimal (+2/-2 lines) and defensive.
Changed components
storage/storage.cstorage_change_wipe_code()MPU reconfiguration during wipe code operationsInspect captured patch +2 / −2
diff --git a/storage/storage.c b/storage/storage.c
index 48d80a51..04fb7767 100644
--- a/storage/storage.c
+++ b/storage/storage.c
@@ -1684,12 +1684,12 @@ secbool storage_change_wipe_code(const uint8_t *pin, size_t pin_len,
return secfalse;
}
+ mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_STORAGE);
+
ui_progress_init(STORAGE_PIN_OP_VERIFY);
ui_message =
(pin_len != 0 && wipe_code_len == 0) ? VERIFYING_PIN_MSG : PROCESSING_MSG;
- mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_STORAGE);
-
secbool ret = unlock(pin, pin_len, ext_salt);
if (sectrue != ret) {
goto end;
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.