fix(nordic/ble): fix stack overflow crash
What the developer wrote
Authored by tychovrahe
fix(nordic/ble): fix stack overflow crash
[no changelog]
What changed, and why it matters
This commit fixes a Bluetooth Low Energy (BLE) crash in Trezor hardware wallets caused by a stack overflow. The patch does two things: it stops placing the device advertising name on the thread stack by using a static buffer instead, and it increases the BLE management thread's stack size from the default to 2048 bytes. The change reduces the chance that a long or specially crafted device name could corrupt nearby memory or crash the BLE subsystem. There is no vendor statement that this is a security vulnerability, and no independent researcher is credited.
Treat as a stability/reliability fix with potential security hardening value. Users on affected firmware should update to a build containing this commit. Developers should verify that `BLE_ADV_NAME_LEN` bounds are enforced before `advertising_start` is called and consider stack usage analysis for the BLE management thread. No immediate incident response is indicated absent a separate security advisory.
Security signals we found
Stack overflow crash fixed in BLE firmware
Stack-allocated/caller buffer replaced with static bounded buffer for advertising name
BLE management thread stack size explicitly increased from default to 2048 bytes
No changelog entry ([no changelog])
No CVE, advisory, or researcher attribution present in commit
Evidence from the diff
In advertising.c, the advertising payload’s name field previously pointed directly to a stack-allocated or caller-provided name buffer. The patch copies the name into a new static buffer adv_name[BLE_ADV_NAME_LEN + 1] before referencing it, removing a stack-local string from the advertising setup path. In ble_management.c, the Zephyr thread definition K_THREAD_DEFINE is changed from CONFIG_DEFAULT_THREAD_STACK_SIZE to an explicit 2048-byte stack. Together these changes address a reported stack overflow crash in the Nordic BLE firmware. The diff itself does not show an exploitable memory corruption primitive, only a crash-hardening fix; however, stack overflows on embedded BLE stacks can in principle lead to denial of service or, under favorable conditions, controlled memory corruption.
Changed components
nordic/trezor/trezor-ble/src/ble/advertising.cnordic/trezor/trezor-ble/src/ble/ble_management.cTrezor Safe firmware BLE subsystem (Nordic nRF-based BLE stack)Inspect captured patch +7 / −3
diff --git a/nordic/trezor/trezor-ble/src/ble/advertising.c b/nordic/trezor/trezor-ble/src/ble/advertising.c
index 5b45737a..601df3b2 100644
--- a/nordic/trezor/trezor-ble/src/ble/advertising.c
+++ b/nordic/trezor/trezor-ble/src/ble/advertising.c
@@ -169,7 +169,11 @@ void advertising_start(bool wl, bool user_disconnect, uint8_t color,
/* Fill second element for the name */
advertising_data[1].type = BT_DATA_NAME_COMPLETE;
advertising_data[1].data_len = name_len;
- advertising_data[1].data = (const uint8_t *)name;
+
+ static char adv_name[BLE_ADV_NAME_LEN + 1] = {0};
+ memset(adv_name, 0, BLE_ADV_NAME_LEN + 1);
+ memcpy(adv_name, name, name_len);
+ advertising_data[1].data = (const uint8_t *)adv_name;
char gap_name[BLE_ADV_NAME_LEN + 1] = {0};
memcpy(gap_name, name, name_len);
diff --git a/nordic/trezor/trezor-ble/src/ble/ble_management.c b/nordic/trezor/trezor-ble/src/ble/ble_management.c
index 14826e6b..997c63d9 100644
--- a/nordic/trezor/trezor-ble/src/ble/ble_management.c
+++ b/nordic/trezor/trezor-ble/src/ble/ble_management.c
@@ -253,5 +253,5 @@ void ble_management_thread(void) {
}
}
-K_THREAD_DEFINE(ble_management_thread_id, CONFIG_DEFAULT_THREAD_STACK_SIZE,
- ble_management_thread, NULL, NULL, NULL, 7, 0, 0);
+K_THREAD_DEFINE(ble_management_thread_id, 2048, ble_management_thread, NULL,
+ NULL, NULL, 7, 0, 0);
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.