Sonos Era 100 Secure Boot Bypass Through Unchecked setenv() call

The Sonos Era 100 speakers uses UBoot for the basic boot process. UBoot is a common microcontroller boot framework that has a lot of existing functionality but can be crafted for whatever you need. The Sonos team created a custom sonosboot command that loads the kernel image, does the signature check then passes execution over to the bootm command. bootm command uses environment variables from UBoot for various configurations. In order to ensure that only trusted parameters are used, the implementation calls setenv(). However, the error message is NOT checked for this call. Can we abuse this? By interacting with the UBoot console or modifying the eMMC memory directly, we can control these variables. Normally, these would be overwritten. UBoot allows for the setting of environment variables as read only though. This can be done with bootargs=something then setting the flags with .flags=bootargs:sr. Now, going forward, any future writes to bootargs will fail. Now, as an attacker, we can set any of the ENV variables we want then make them read only to ensure that the setenv() call fails. The authors set the initrd variable to control the initramfs image that was loaded, hijacking the boot process. I really enjoy vulnerabilities that result in things failing in weird ways like this. Not handling errors can have devastating consequences even when it seems impossible that something would fail. Good article!