Phison PS3111-S11 SSD firmware: signature check trusts a modulus carried in the image, so any firmware verifies

CVSS 9.3CVE-2026-82876Firmware, BMC & network fabriccurated

Impact

The controller verifies the RSA signature of a firmware image using a public modulus taken from the image's own signature segment rather than one anchored in immutable storage. Anyone able to flash the drive can generate their own key pair, sign modified firmware, embed the matching modulus, and the controller accepts it - the signature check validates the attacker against themselves. The result is persistent code on the storage controller that survives OS reinstall, disk wipe and reimaging, which is the failure mode that matters when a machine is re-racked or handed to the next tenant. Note the scope: PS3111-S11 is an entry-level SATA controller found in low-cost drives, so a fleet's NVMe data plane is not affected - the exposure is wherever such drives ended up as boot or scratch media.

Who can reach it

Local, with high privilege on the host - root or equivalent able to issue vendor firmware-download commands to the drive (or physical access to the device). Not reachable from a container or an unprivileged tenant process on its own; it is a post-compromise persistence and supply-chain concern.

What to do

The record carries no vendor firmware fix - the references are the researcher's write-up and the VulnCheck advisory, not a Phison advisory - so treat this as mitigate-only until Phison publishes something. The root-of-trust design cannot be corrected by an operator. Practical steps: inventory whether any PS3111-S11 drives are deployed, keep raw block-device and vendor-command access restricted to the host root context, and do not return such drives to a shared pool after a tenant or an incident - retire them rather than re-provisioning, since firmware state cannot be attested.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-82876 https://www.vulncheck.com/advisories/phison-ps3111-s11-controller-firmware-signature-verification-bypass https://trulycrisp.github.io/drivefirmware/phison_s11/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.