attestation: fix missing cleanup on failed efuse write
What the developer wrote
Authored by Mike Tolkachev
attestation: fix missing cleanup on failed efuse write
What changed, and why it matters
This commit fixes a small but real bug in the device attestation setup code for Blockstream Jade, a hardware crypto wallet. When a one-time programmable security fuse failed to burn, the code used to exit immediately without releasing memory or undoing earlier setup steps. The fix makes it jump to a cleanup routine instead. The direct risk is mainly a resource leak or partial initialization state on a rare hardware failure, not an obvious remote attack.
Treat as a low-to-moderate reliability/defensive fix. Review the full cleanup label to confirm all resources and partial state are properly handled. Include in routine firmware updates; no urgent advisory appears necessary unless paired with a demonstrated exploit or denial-of-service path.
Security signals we found
Missing cleanup on error path in security-critical initialization
Resource leak on failed efuse write
Potential inconsistent attestation state after partial initialization
Attestation/secure-boot efuse code touched
Evidence from the diff
In main/attestation/attestation.c, attestation_initialise() previously returned false directly after esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS) failed. The function has a cleanup label used elsewhere for freeing resources and resetting state. The patch changes the early return to goto cleanup so that allocated objects (e.g., mbedtls contexts, keys, buffers) and any partially written state are handled consistently. This is a missing cleanup path, not a logic or cryptographic flaw in the attestation protocol itself.
Changed components
main/attestation/attestation.cattestation_initialise()ESP32 efuse write pathInspect captured patch +1 / −1
diff --git a/main/attestation/attestation.c b/main/attestation/attestation.c
index 0eaf807..d2ce463 100644
--- a/main/attestation/attestation.c
+++ b/main/attestation/attestation.c
@@ -596,7 +596,7 @@ bool attestation_initialise(const char* privkey_pem, const size_t privkey_pem_le
err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
if (err != ESP_OK) {
JADE_LOGE("Failed to burn disable-read-protection single-bit efuse");
- return false;
+ goto cleanup;
}
#endif
Why this scored 39/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.