fix(core): fix crash when setting wipe code
What the developer wrote
Authored by tychovrahe
fix(core): fix crash when setting wipe code
[no changelog]
What changed, and why it matters
This commit fixes a crash that could occur when setting or changing the Trezor device's wipe code (a special PIN that wipes the device). The fix moves a memory-protection reconfiguration call earlier, before user-interface progress initialization. The crash appears to be a reliability bug rather than a security vulnerability that would let an attacker steal funds, but a crash during security-sensitive wipe-code setup could disrupt the user experience or potentially be used in a denial-of-service scenario.
Treat as a stability and hardening fix. Review whether the crash could be triggered by user input or malicious host interaction during wipe-code setup. Apply the patch and consider regression tests for wipe-code and PIN change flows under memory-protected conditions.
Security signals we found
Memory Protection Unit (MPU) configuration ordering change
Crash fix in security-critical wipe-code/PIN operation
UI progress initialization moved after MPU reconfiguration
Potential denial-of-service vector: device crash during wipe-code setup
Evidence from the diff
In storage/storage.c, storage_change_wipe_code() previously called ui_progress_init() before mpu_reconfig(MPU_MODE_STORAGE). The patch swaps the order so the MPU is reconfigured into storage mode first, then the UI progress is initialized. The crash likely stemmed from the UI/progress code triggering memory access or an interrupt/fault path while the MPU was not in the expected storage configuration, causing a hard fault. Moving MPU reconfiguration earlier ensures the memory protection context is correct before any UI code runs during the wipe-code operation.
Changed components
storage/storage.cstorage_change_wipe_code()MPU memory protection subsystemwipe code / PIN verification flowInspect captured patch +2 / −2
diff --git a/storage/storage.c b/storage/storage.c
index 48d80a51..04fb7767 100644
--- a/storage/storage.c
+++ b/storage/storage.c
@@ -1684,12 +1684,12 @@ secbool storage_change_wipe_code(const uint8_t *pin, size_t pin_len,
return secfalse;
}
+ mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_STORAGE);
+
ui_progress_init(STORAGE_PIN_OP_VERIFY);
ui_message =
(pin_len != 0 && wipe_code_len == 0) ? VERIFYING_PIN_MSG : PROCESSING_MSG;
- mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_STORAGE);
-
secbool ret = unlock(pin, pin_len, ext_salt);
if (sectrue != ret) {
goto end;
Why this scored 40/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.