CVE-2023-21252 AI-generated analysis
platform/packages/modules/Wifi, Wi-Fi service (WifiConfigurationUtil, WifiConfiguration validation)
Adds an isWapi flag to WifiConfigurationUtil.validatePassword. A WAPI-PSK hex preSharedKey is then capped at 100 characters instead of going through the generic PSK_SAE_HEX_LEN rule. Per the commit message, the goal is to stop arbitrarily large passwords.
Root cause
WifiConfigurationUtil.validatePassword had no notion of the WAPI security type. Its hex-PSK branch applied one rule (length == PSK_SAE_HEX_LEN) to every caller, and the SECURITY_TYPE_WAPI_PSK call site in validate() passed the same arguments (isAdd, isSae=false) as WPA-PSK. The commit message says the goal is to stop arbitrarily large WAPI passwords, and the diff adds an explicit WAPI-specific upper bound of 100 characters on the hex string. The material does not show a code state in which WAPI passwords were unbounded: in the shown pre-image, WAPI already went through the exact PSK_SAE_HEX_LEN check.
How the fix works
- service/java/com/android/server/wifi/WifiConfigurationUtil.java:validatePassword: the signature is extended to validatePassword(String password, boolean isAdd, boolean isSae, boolean isWapi). In the hex-PSK branch (password does not start with a double quote), when isWapi is true the password is rejected if password.length() > 100, with the log 'validatePassword failed: WAPI hex string too long'. Otherwise the existing exact check password.length() != PSK_SAE_HEX_LEN still applies.
- service/java/com/android/server/wifi/WifiConfigurationUtil.java:validate (isAdd-aware path, hunk at new line 733): the SECURITY_TYPE_PSK and SECURITY_TYPE_SAE calls pass isWapi=false, and the SECURITY_TYPE_WAPI_PSK call now passes isWapi=true.
- service/java/com/android/server/wifi/WifiConfigurationUtil.java: a second validation path (hunk at new line 905, PSK and SAE only) is updated to pass isWapi=false. No WAPI call is added there.
- service/tests/wifitests/src/com/android/server/wifi/WifiConfigurationUtilTest.java: the negative test key changes from a 40-character string to a 101-character digit string, which is expected to fail validate(..., VALIDATE_FOR_ADD).
Completeness
- The fix covers only the hex (unquoted) preSharedKey path for SECURITY_TYPE_WAPI_PSK in WifiConfigurationUtil.validate. The bound is a hard-coded literal (100), not a named constant.
- This diff leaves the quoted ASCII path unchanged. The visible context shows only a minimum-length check (targetMinLength) for ASCII strings; any maximum check for ASCII is not shown.
- The second validation routine (hunk at new line 905) validates only PSK and SAE passwords and gets no WAPI check. Whether WAPI configurations can reach that routine is not shown.
- PSK and SAE keep the existing exact PSK_SAE_HEX_LEN check. DPP and other security types are untouched.
- In the shown pre-image, WAPI hex keys were subject to the exact PSK_SAE_HEX_LEN check. After the fix they only fail the length check when longer than 100 characters, which relaxes the length rule for shorter keys.
Behavior changes
- A WAPI-PSK hex preSharedKey longer than 100 characters is rejected by WifiConfigurationUtil.validate, with Log.e 'validatePassword failed: WAPI hex string too long: <len>'.
- A non-empty WAPI-PSK hex preSharedKey of 100 characters or fewer no longer has to equal PSK_SAE_HEX_LEN in length. Whether later checks in the branch still apply is not shown.
- PSK and SAE validation is unchanged. The private validatePassword signature gains a fourth boolean parameter (internal API only).
Per major
- Android 14: same fix: commit 1d72a8130807 (cherry-pick of 38707fb4ff1405663cc24affc95244f4cc830499, Change-Id I15f3aff373af56c253a50c308d886a7acf661e59) in android-security-14.0.0_r1, also present as 9051eef78a76 in android-security-14.0.0_r2. At android-security-14.0.0_r29, 7/8 lines of the patched region are present.
- Android 15: not affected (not listed by the bulletin). At android-security-15.0.0_r17, 7/8 lines of the patched region are present.
- Android 16: not affected (not listed by the bulletin). At android-security-16.0.0_r8, 7/8 lines of the patched region are present.
- Android 17: not affected (not listed by the bulletin). At android-security-17.0.0_r1, 7/8 lines of the patched region are present.
Unknowns
- The pre-fix code state in which WAPI passwords were unbounded. In the pre-image shown here, the WAPI call already went through the exact PSK_SAE_HEX_LEN check, so the material does not show how 'arbitrarily large' passwords were accepted before this commit.
- Which downstream consumer of the WAPI preSharedKey was affected by large values, and the concrete DoS effect. The bulletin gives only the DoS type and High severity.
- Which entry points call WifiConfigurationUtil.validate, and which security type the modified negative test configures.
- The value of PSK_SAE_HEX_LEN, why 100 was chosen as the bound, and whether the quoted ASCII WAPI path has its own maximum.