B2CA-2795: Security review - #171
Merged
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #171 +/- ##
========================================
Coverage 40.19% 40.19%
========================================
Files 1 1
Lines 209 209
Branches 49 49
========================================
Hits 84 84
Misses 118 118
Partials 7 7
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
bboilot-ledger
approved these changes
Aug 11, 2026
…owngrade READ_ASYM_KEY now requires the stored key size to exactly match the attribute-declared size. This closes the path where a PW3-authorized attribute downgrade (e.g. RSA-4096 → RSA-2048) let an unauthenticated READ_ASYM_KEY reinterpret private-exponent bytes as a public modulus. PUT DATA for algorithm attributes (0xC1/0xC2/0xC3) now atomically erases the owning gpg_key_t before writing the new attributes, matching the behaviour already implemented in the UX template path. This ensures stale key material can never coexist with mismatched attributes.
…ong PIN ID pin_confirm_cb was calling gpg_pin_set_verified with the live io_p2, which could be overwritten by a new APDU arriving while the confirmation screen was displayed. A host could send a VERIFY for PW3 (Admin) just before the user tapped 'Yes' on a User-82 confirmation, resulting in Admin being marked verified without entering the admin PIN. The fix has two layers: 1. Snapshot: io_p2 is captured in ux_pinconfirm_p2 at the moment the UI is drawn. All callbacks use this snapshot instead of the live io_p2. 2. Guard: gpg_dispatch rejects any APDU received while ui_pending is set with SWO_CONDITIONS_NOT_SATISFIED, so no command can complete behind a pending prompt. ui_pending is set at draw time and cleared at the start of each UI callback.
Replace sizeof(field_expression) checks with named constants so sizeof is never applied to expressions containing pointer dereferences or variable reads. Update gpg_types.h struct definition to use the same constants.
Fixes cross-user cache disclosure and parse-time crash in undici's cache interceptor (transitive dep via jsdom and vitest).
cedelavergne-ledger
force-pushed
the
cev/security_review
branch
from
August 11, 2026 15:20
56b7583 to
68a5317
Compare
Contributor
Code coverage reportPer-file coverage
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Checklist
develop