Phison PS3111-S11 SSD firmware: vendor unique commands allow persistent implants in controller flash

Impact

A local user who already holds privileged raw ATA access to the drive can defeat the CRC-16 based unlock handshake - or find builds with no VUC lock at all - and then read and write controller memory and raw NAND directly. That yields an implant below the filesystem that survives power cycles, OS reinstall and reimaging, which is precisely the boundary a GPU operator relies on when recycling a node between tenants or jobs. Exposure depends on the fleet: PS3111-S11 is an entry-level SATA controller, most often found in cheap boot or scratch SSDs rather than enterprise NVMe, so the first task is inventory. The record establishes firmware read/write and persistence; it does not describe a remote or unprivileged path.

Who can reach it

Local user able to issue raw ATA passthrough commands to the drive - root or equivalent holding the block device. No network exposure and no valid credential is needed once the vendor-command lock is bypassed.

What to do

The record names no fixed firmware version - everything through SBFQT1.3 is affected and no vendor patch is cited - so treat this as mitigate-only for now. Inventory which nodes carry PS3111-S11 based drives, restrict raw ATA passthrough to the drive from tenant and non-root contexts, and stop trusting reimaging alone to clean a suspect boot drive: physically replace it instead. If a drive OEM later ships fixed firmware, flashing it takes the node out of service.

References

Related entries

• Junos OS on SRX: stack overflow in UTM Anti-Spam SBL lets a malformed DNS reply run code as rootCVE-2026-101955 · Juniper Junos OS on SRX Series (UTM Anti-Spam SBL DNS lookup)Critical
• Junos OS on SRX: SQL injection in ipfd lets a Security Intelligence feed execute code as rootCVE-2026-101997 · Juniper Junos OS on SRX Series (ipfd, Security Intelligence feed handling)Critical
• Junos OS on SRX: XML injection in utmd lets a malicious URL-feed server commit device configuration as rootCVE-2026-102037 · Juniper Junos OS on SRX Series (utmd, custom URL-feed server response parsing)Critical
• Junos OS on SRX: format string flaw in ipfd gives root code execution from an impersonated HTTPS feed serverCVE-2026-102062 · Juniper Junos OS on SRX Series (ipfd, HTTPS feed server response handling)Critical
• Junos OS Evolved kernel: crafted TCP packet panics the switch when BGP/LDP key-chain auth is usedCVE-2026-102068 · Juniper Junos OS Evolved kernel (TCP key-chain authentication for BGP/LDP)Critical
• Junos OS: reachable assertion in the TWAMP client lets one TCP packet kill rmopdCVE-2026-102070 · Juniper Junos OS rmopd (TWAMP client)Critical