Replay Protected Memory Block (RPMB) protocol as specified for eMMC, UFS and ALL versions of NVMe

Impact

RPMB is the small authenticated region storage devices provide so a host can keep trusted firmware and anti-rollback state where software cannot forge it. The protocol as SPECIFIED - not one vendor's bug, but the standard itself, across eMMC, UFS and every version of NVMe - permits replay attacks that let an attacker roll the protected region back to an earlier state. That undermines the anti-rollback guarantee that firmware-integrity schemes are built on, so an attacker can reinstate previously-revoked firmware or state. This is a foundational-trust issue rather than a data-read issue: the mechanism your platform uses to prove firmware has not been downgraded can itself be replayed. Because it is written into the standard, it is present across vendors and generations simultaneously - the widest blast radius of anything in this category.

Who can reach it

An attacker with physical access to the device, or with the ability to interpose on the host-to-device command path, capturing and replaying RPMB message sequences. Multi-vendor by construction, since the flaw is in the specification that every implementer followed.

What to do

No single patch exists - remediation is per-implementation and depends on the host software and the device firmware cooperating, which is why CERT/CC coordinated it across vendors rather than issuing one fix. Check each storage vendor's advisory for your specific SKUs (Western Digital published WDC-20008; CERT/CC VU#231329 tracks the multi-vendor response) and apply device firmware plus any host-side platform firmware updates they name. Practically, most operators will not be able to close this on existing fleet hardware, so treat RPMB-backed anti-rollback as a control you cannot fully rely on: do not let it be the only thing preventing a firmware downgrade. Keep an independent record of expected firmware versions per drive serial, and alert on any drive whose reported firmware version goes BACKWARDS between inventory scans - a downgrade you detect is far more useful than an anti-rollback guarantee you cannot verify.

References