fix(core): fix device not accepting BLE messages after wakeup
What the developer wrote
Authored by tychovrahe
fix(core): fix device not accepting BLE messages after wakeup
[no changelog]
What changed, and why it matters
This is a one-line bug fix in the Bluetooth Low Energy (BLE) driver for Trezor hardware wallets. When the device went to sleep and later woke up, it was incorrectly deciding whether to accept incoming BLE messages based on whether it was currently connected. The fix makes it remember and restore the previous 'accept messages' setting instead. This could have caused the device to ignore legitimate Bluetooth messages after waking up, potentially affecting connectivity or user experience, but there is no direct evidence it enables theft of funds or unauthorized access.
Treat as a low-risk functional bug fix. Review whether the accept_msgs state can be manipulated by an attacker to cause persistent denial of service or to alter pairing/connection behavior. No immediate security response is indicated by the available evidence.
Security signals we found
Bluetooth state preservation bug across suspend/resume
Potential denial-of-service: device may refuse BLE messages after wakeup
Potential state inconsistency: accept_msgs could be enabled when not intended
No explicit security context, CVE, or advisory in commit or supplied references
Evidence from the diff
In core/embed/io/ble/stm32/ble.c, ble_suspend() previously saved wakeup_params->accept_msgs = drv->connected. After wakeup, this value controls whether the BLE stack accepts incoming messages. The patch changes this to wakeup_params->accept_msgs = drv->accept_msgs, preserving the actual accept_msgs state across suspend/resume. The bug meant a connected device that had accept_msgs disabled would incorrectly enable message acceptance, or a disconnected device that had accept_msgs enabled would incorrectly disable it after wakeup. The commit message frames this as a functional fix with no changelog and no security claims.
Changed components
core/embed/io/ble/stm32/ble.cBLE suspend/resume pathTrezor Core firmware BLE driverInspect captured patch +1 / −1
diff --git a/core/embed/io/ble/stm32/ble.c b/core/embed/io/ble/stm32/ble.c
index d41037563..d9cb9d7d4 100644
--- a/core/embed/io/ble/stm32/ble.c
+++ b/core/embed/io/ble/stm32/ble.c
@@ -660,7 +660,7 @@ void ble_suspend(ble_wakeup_params_t *wakeup_params) {
if (drv->initialized) {
bool connected = drv->connected;
- wakeup_params->accept_msgs = connected;
+ wakeup_params->accept_msgs = drv->accept_msgs;
wakeup_params->mode_requested = drv->mode_requested;
wakeup_params->peer_count = drv->peer_count;
wakeup_params->high_speed = drv->high_speed;
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.