How the bug shipped

Four commits built the vulnerable path. Two landed as direct pushes; the two opened as pull requests were merged with no review recorded on GitHub.

commits

direct pushes · no PR

2 PRs → 0

reviews

Source commits+

switck/libnguf19de05

x — the entire commit message

switckcommitted on 28 Jan 2021

28 files changed+881−200Direct push · no PR

ngu/random.c +12 −1

@@ -19,9 +19,20 @@
 # define CHIP_TRNG_32()         esp_random()
 #endif
 
+#ifdef MICROPY_PY_STM
+// ports/stm32/rng.c
+extern uint32_t rng_get(void);
+# define CHIP_TRNG_SETUP()      
+# define CHIP_TRNG_32()         rng_get()
+
+# ifndef MICROPY_HW_ENABLE_RNG
+# error "get a HW TRNG plz"
+# endif
+#endif
+
 #ifdef UNIX
 # define CHIP_TRNG_SETUP()      
-# define CHIP_TRNG_32()       arc4random()
+# define CHIP_TRNG_32()         arc4random()
 #endif
 
 #ifndef CHIP_TRNG_SETUP

Adds the build-time guard that tests whether MICROPY_HW_ENABLE_RNG is defined rather than what it is set to. This is the defect. View commit ↗

Coldcard/firmwareb18723d

First pass w/ libNgU

doc-hexcommitted on 1 Mar 2021

120 files changed+2,766−2,722Direct push · no PR

Moves COLDCARD onto libngu — built on libsecp256k1, the library Bitcoin Core uses — and rewrites seed generation, in the same change that strips the GPL-licensed crypto libraries. 120 files. View commit ↗

switck/libngu61ffc74

Add reseed function to ngu.random module

doc-hexcommitted on 11 Mar 2022Verified

2 files changed+15−0#18 merged0 reviews

ngu/random.c +10 −0

 STATIC MP_DEFINE_CONST_FUN_OBJ_1(random_bytes_obj, random_bytes);
 
 
+STATIC mp_obj_t random_reseed(mp_obj_t arg)
+{
+    yasmarang_pad = mp_obj_get_int_truncated(arg);
+
+    return mp_const_none;
+}
+STATIC MP_DEFINE_CONST_FUN_OBJ_1(random_reseed_obj, random_reseed);
+
+
 STATIC const mp_rom_map_elem_t globals_table[] = {
     { MP_ROM_QSTR(MP_QSTR___name__), MP_ROM_QSTR(MP_QSTR_random) },
 
     { MP_ROM_QSTR(MP_QSTR_bytes), MP_ROM_PTR(&random_bytes_obj) },
     { MP_ROM_QSTR(MP_QSTR_uint32), MP_ROM_PTR(&random_uint32_obj) },
     { MP_ROM_QSTR(MP_QSTR_uniform), MP_ROM_PTR(&random_uniform_obj) },
+    { MP_ROM_QSTR(MP_QSTR_reseed), MP_ROM_PTR(&random_reseed_obj) },
 };
 
 STATIC MP_DEFINE_CONST_DICT(globals_table_obj, globals_table);

Adds the reseed entry point that later devices call at boot — the one that keeps only four bytes. View commit ↗

Coldcard/firmware01cb43f

Seed RNG with RNG from both SE's

doc-hexcommitted on 11 Mar 2022Verified

9 files changed+113−12#90 merged0 reviews

Mixes secure-element entropy into the generator on Mk4 and later, capping those devices at 2^32 rather than repairing the fallback. View commit ↗