Downgrade Prevention

To prevent devices from being downgraded to firmware versions with known vulnerabilities, MCUboot supports downgrade prevention policies, divided into software downgrade prevention and hardware downgrade prevention. Software downgrade prevention can be further divided into version number-based and security counter-based approaches.

Software Downgrade Prevention (Version Number Based)

Version number-based software downgrade prevention only exists in !BOOT_DIRECT_XIP upgrade mode. This method is purely software-based downgrade prevention and does not prevent physical attacks (such as Flash erase/rewrite).

  1. Principle:

    • MCUboot compares firmware version numbers at each boot.

    • If the new firmware version number is lower than the currently running firmware version number, boot is rejected.

    • If the new firmware version number is greater than or equal to the currently running firmware version, boot is allowed.

  2. Configuration:

    CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=y

  3. Embed version number during firmware signing:

    # Example: Set in application prj.conf or board-specific configuration
CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION="0.0.1"

Note

The version number is embedded in the image_version struct within the firmware image header (see MCUboot App Firmware).

Software Downgrade Prevention (Security Counter Based)

Security counter-based software downgrade prevention only exists in (BOOT_SWAP_USING_MOVE || BOOT_SWAP_USING_SCRATCH || BOOT_SWAP_USING_OFFSET) mode. This method is purely software-based downgrade prevention and does not prevent physical attacks (such as Flash erase/rewrite).

  1. Principle:

    • MCUboot compares security counter values at each boot.

    • If the new firmware’s security counter is less than the currently running firmware’s security counter, boot is rejected.

    • If the new firmware’s security counter is greater than or equal to the currently running firmware’s security counter, boot is allowed.

  2. Configuration:

    CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=y        # security counter option depends on this configuration
CONFIG_MCUBOOT_DOWNGRADE_PREVENTION_SECURITY_COUNTER=y

  3. Embed security counter during firmware signing:

    # Example: Set in application prj.conf or board-specific configuration
CONFIG_MCUBOOT_EXTRA_IMGTOOL_ARGS="--security-counter 1"

Note

The security counter is embedded as an IMAGE_TLV_SEC_CNT (0x50) entry in the image’s protected TLV area (see MCUboot App Firmware).

Hardware Downgrade Prevention (OTP Based)

  1. Principle:

    • MCUboot saves the currently accepted security counter to a hardware counter (OTP).

    • If the new firmware’s security counter is less than the OTP recorded value, boot is rejected.

    • If the new firmware’s security counter is greater than or equal to the OTP recorded value, boot is allowed.

  2. Configuration:

    CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION=y

  3. Embed security counter during firmware signing:

    # Example: Set in application prj.conf or board-specific configuration
CONFIG_MCUBOOT_EXTRA_IMGTOOL_ARGS="--security-counter 1"

Note

  • The security counter is stored in a 32-bit OTP word at address 0x380 (sysreg_sec offset 0x380[31:0]).

  • Hardware counters have an upper limit; please only update when necessary, as reaching the limit may cause device boot failure.