Description

Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the signature segment, and the controller accepts the tampered firmware as valid.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-31T11:16:41.190Z",
  "pubdate": "2026-08-31T11:16:41.190Z",
  "executiveSummary": "The Phison PS3111-S11 controller suffers from a critical firmware integrity verification vulnerability. The root cause lies in the controller's implementation of RSA signature verification, which relies on a public modulus stored within the mutable firmware image rather than an immutable, hardware-rooted trust anchor.\nThis design flaw permits an attacker with write access to the firmware update mechanism to bypass signature checks entirely. By generating a custom RSA key pair, the attacker can sign malicious firmware blobs and include the corresponding public modulus within the signature segment. The controller, failing to validate the modulus against a trusted source, accepts the tampered firmware as legitimate.\nThe impact of this vulnerability is severe, allowing for persistent, low-level system compromise. Because the malicious firmware resides on the controller, the attacker gains control over storage operations, potentially enabling data exfiltration, stealthy persistence, or the deployment of secondary payloads that survive traditional OS-level reinstallation. This vulnerability necessitates physical or firmware-level access for exploitation and presents a significant risk to the integrity of the data stored on affected SSDs.",
  "technicalDetails": "The Phison PS3111-S11 controller utilizes an RSA-based cryptographic signature scheme to authenticate incoming firmware updates. However, the security mechanism is fundamentally flawed due to the storage location of the public key component. Instead of anchoring the public modulus in ROM, OTP (One-Time Programmable) memory, or a secure element, the controller retrieves the modulus directly from the firmware image currently undergoing validation.\nExploitation proceeds through a structured process of firmware subversion. First, an attacker modifies the existing firmware image to include malicious logic. Since the signature verification process is effectively bypassed, the attacker does not need to compromise the vendor's private signing key. Instead, the attacker generates a new, arbitrary RSA key pair (public/private).\nThe attacker then updates the signature segment of the modified firmware image. They replace the legitimate public modulus with the public modulus from their generated key pair and sign the malicious binary with the corresponding private key. When the controller initiates the firmware update or verification process, it parses the firmware segment to obtain the public modulus. Because the implementation lacks a trust anchor to verify that the modulus belongs to the manufacturer, it uses the attacker-provided modulus to verify the signature of the malicious firmware.\nUpon successful validation of the signature against the attacker's public key, the PS3111-S11 controller proceeds to write the malicious firmware to its internal flash storage. This results in the execution of arbitrary code within the controller's processor context. Post-exploitation, the attacker gains total control over the storage device. This level of access enables the interception of data buffers, manipulation of logical-to-physical block mapping to hide files, and the creation of a 'rootkit' that is transparent to the host operating system's security software.\nThe vulnerability is restricted to the controller's internal logic and does not require network exposure; however, it requires the ability to trigger a firmware update or write to the device's firmware flash area, typically requiring administrative or physical access to the system. There are no authentication mechanisms within the controller itself that would prevent a properly formatted firmware image from being processed if the integrity check is successfully fooled by the substituted modulus."
}