From 08f82dbfd0538d481feb68bb4f903b2af2bc8024 Mon Sep 17 00:00:00 2001 From: Nate Gay Date: Mon, 31 Aug 2026 09:17:15 -0500 Subject: [PATCH 1/3] Upgrade to Zephyr 4.4.2 Bump the west manifest and the lib/zephyr-workspace/zephyr submodule from v4.4.1 to v4.4.2, a 197-commit security and bugfix release on the v4.4 branch. No module pins change. The only revision that moved in upstream's west.yml between the tags is hal_espressif, which this trimmed manifest does not import; all ten modules we do pin (cmsis, cmsis_6, hal_rpi_pico, hal_st, picolibc, mbedtls, tf-psa-crypto, mcuboot, fatfs, loramac-node) still match v4.4.2's manifest exactly. Of note for this deployment, 4.4.2 carries a MCUboot Kconfig fix for the RAM-revert confirmed-image path (c219dde148e), which touches the OTA swap logic. Builds: make build and make build-mcuboot both clean, console still disabled. Bootloader flash 7.30%, RAM 3.31%. --- lib/zephyr-workspace/zephyr | 2 +- west.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/zephyr-workspace/zephyr b/lib/zephyr-workspace/zephyr index 1f6485ec..dccb0959 160000 --- a/lib/zephyr-workspace/zephyr +++ b/lib/zephyr-workspace/zephyr @@ -1 +1 @@ -Subproject commit 1f6485eca25431b5ff27ce9a754218c9e559bbbb +Subproject commit dccb09599635bdff17633fa7e9dab014b91dce90 diff --git a/west.yml b/west.yml index 73f68164..8a74990f 100644 --- a/west.yml +++ b/west.yml @@ -17,7 +17,7 @@ manifest: # Zephyr RTOS core - name: zephyr repo-path: zephyr - revision: v4.4.1 + revision: v4.4.2 path: lib/zephyr-workspace/zephyr west-commands: scripts/west-commands.yml import: From 80069ea4d3f54c5332d34ff1a03c88687ae4570a Mon Sep 17 00:00:00 2001 From: Nate Gay Date: Mon, 31 Aug 2026 09:29:48 -0500 Subject: [PATCH 2/3] Bump mbedtls and tf-psa-crypto to the v4.4 maintenance revisions Take Mbed TLS 4.1.1 and TF-PSA-Crypto 1.1.1, the revisions Zephyr's v4.4-branch already moved to after tagging 4.4.2. This is the only module movement on the stable branch, so it is what 4.4.3 will ship; taking it now keeps us on the tested combination rather than ahead of it. TF-PSA-Crypto 1.1.1 carries six CVEs. None reach either image as configured, so this is not an urgent fix: - CVE-2026-50587 (RSA PKCS#1 v1.5 decryption side channel), RSA key generation timing: we do no private-key operations and generate no keys on device. MCUboot verifies with an RSA-2048 public key under PSS. - CVE-2026-50584 (ChaCha20 counter wrap), CVE-2026-54434 (x25519 Everest low-order point): neither primitive is enabled. - CVE-2026-54435 (ECC scalar multiplication side channel), CVE-2026-50583 (1-byte overread parsing a malformed ECC public key): no ECC is compiled in. The application enables only HMAC and SHA-256 (prj.conf), the bootloader only RSA-PSS verify and SHA-256. Sizes are unchanged in both images, consistent with the changed code sitting entirely in paths we do not compile. --- west.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/west.yml b/west.yml index 8a74990f..5ab62820 100644 --- a/west.yml +++ b/west.yml @@ -68,13 +68,13 @@ manifest: # Crypto libraries (commonly used) - name: mbedtls - revision: a3e190fe44c78d1ba67f55979e1257328cc7d0d8 + revision: 098e120afb51877ed814bdc04443890ae12e0642 path: lib/zephyr-workspace/modules/crypto/mbedtls groups: - crypto - name: tf-psa-crypto - revision: dc575a2ddcc8cb16275d24c42a52eaf79ebe2231 + revision: fa92349590a54959ee2efc21b668e5afdb144726 path: lib/zephyr-workspace/modules/crypto/mbedtls/tf-psa-crypto groups: - crypto From b26ca4b913bb53e3d08eb339de2e4c5501436c78 Mon Sep 17 00:00:00 2001 From: Nate Gay Date: Mon, 31 Aug 2026 09:30:06 -0500 Subject: [PATCH 3/3] Bump fatfs ahead of the manifest for five filesystem CVEs Unlike the crypto bump, this moves fatfs off the revision Zephyr 4.4.2 pins. The fixes landed in the Zephyr FatFs tree in July 2026 but did not make the 4.4.2 release and are not on v4.4-branch, so waiting for 4.4.3 would not pick them up. Our previous pin dates to October 2025 and is a pristine ChaN R0.16 with none of them applied. Three are mount-time validation, which is the reason to take this. The flight filesystem is FAT with exFAT enabled (prj.conf), and the realistic trigger here is not an attacker-supplied volume but a superblock torn by a hard reset -- the same corruption class that motivated the boot count hardening in #470. Today a malformed BPB faults; with these it is rejected at mount, and CONFIG_FS_FATFS_MOUNT_MKFS reformats and recovers. - CVE-2026-6682: BPB_FATSz32 times the FAT count overflowed a DWORD, laying the data region inside the FAT. Now capped before the multiply. - CVE-2026-6683 (exFAT): a BPB reporting zero clusters made sync_fs() divide by zero on first write or unmount. Rejected at mount instead. - CVE-2026-6687 (exFAT): f_getlabel() looped over an unvalidated on-disk count and overran the caller's buffer. Clamped to the 11-char maximum. The fourth, CVE-2026-6686, zeroes the range exposed when f_lseek() extends a file past end-of-file; that range previously read back stale flash contents. The fifth, CVE-2026-6685, upstream documents as a readability change rather than a real fix. The six commits touch only ff.c and documentation, so there is no Zephyr-side glue to adapt. Costs 280 bytes of flash (64.67% -> 64.70%) for the fill_zero helper; RAM is unchanged. --- west.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/west.yml b/west.yml index 5ab62820..0be7ff7e 100644 --- a/west.yml +++ b/west.yml @@ -84,7 +84,7 @@ manifest: path: lib/zephyr-workspace/bootloader/mcuboot - name: fatfs - revision: f4ead3bf4a6dab3a07d7b5f5315795c073db568d + revision: 4f60a12c58c3de4246857ad87c40239ecd93349b path: lib/zephyr-workspace/modules/fatfs self: