fix(core/bootloader): erase protected backup ram on wipe code entry
What the developer wrote
Authored by tychovrahe
fix(core/bootloader): erase protected backup ram on wipe code entry
[no changelog]
What changed, and why it matters
This bootloader patch makes the device erase a special protected memory region (backup RAM) when the user enters a 'wipe code' to factory-reset the device. Without this cleanup, sensitive leftovers could remain in that protected memory after a wipe. The change is small and defensive, but the commit message does not explain what specific risk it fixes.
Treat as a low-to-moderate security hardening fix. Verify that backup_ram_erase_protected() clears the entire protected region and that all other wipe/reboot paths (firmware wipe, reset, recovery, firmware update) also erase this region or do not leave secrets behind. Request a security note or changelog entry from the vendor explaining the threat model.
Security signals we found
Adds explicit erase of protected backup RAM during wipe-code flow
Located in bootloader, which has high privilege and runs before main firmware
Defensive cleanup of sensitive memory after user-initiated wipe
No changelog entry and minimal commit detail
Evidence from the diff
In core/embed/projects/bootloader/main.c, after wipe_bonds() and before reading bootargs, the bootloader now calls backup_ram_erase_protected() when USE_BACKUP_RAM is defined. This ensures the protected backup RAM region is cleared during a wipe-code triggered reset. The diff itself does not show what data lives in that region, what threat model is addressed, or whether other wipe paths already clear it.
Changed components
Trezor Core bootloadercore/embed/projects/bootloader/main.cProtected backup RAM subsystem (USE_BACKUP_RAM)Inspect captured patch +4 / −0
diff --git a/core/embed/projects/bootloader/main.c b/core/embed/projects/bootloader/main.c
index e9d706ec..aa1751bb 100644
--- a/core/embed/projects/bootloader/main.c
+++ b/core/embed/projects/bootloader/main.c
@@ -539,6 +539,10 @@ int bootloader_main(void) {
wipe_bonds(NULL);
#endif
+#ifdef USE_BACKUP_RAM
+ backup_ram_erase_protected();
+#endif
+
// wipe info was left in bootargs
boot_args_t args;
bootargs_get_args(&args);
Why this scored 57/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.