CVE-2023-40109 AI-generated analysis
platform/frameworks/base, android.hardware.usb (UsbConfiguration Parcelable)
UsbConfiguration.CREATOR.createFromParcel now uses the type-safe Parcel.readParcelableArray(ClassLoader, Class) overload with UsbInterface.class, so a non-UsbInterface element in the interfaces array is rejected when a UsbConfiguration is unparceled.
Root cause
In core/java/android/hardware/usb/UsbConfiguration.java, the Parcelable.Creator read the interfaces array with the untyped in.readParcelableArray(UsbInterface.class.getClassLoader()), which did not restrict elements to UsbInterface. setInterfaces() only runs Preconditions.checkArrayElementsNotNull, and getInterface() casts mInterfaces[index] to UsbInterface, so no element-type check existed on the deserialization path.
How the fix works
- core/java/android/hardware/usb/UsbConfiguration.java: UsbConfiguration.CREATOR.createFromParcel replaces in.readParcelableArray(UsbInterface.class.getClassLoader()) with in.readParcelableArray(UsbInterface.class.getClassLoader(), UsbInterface.class). Per the commit message test line, unparceling now throws an exception for a non-UsbInterface object.
- No other lines change: setInterfaces(), getInterface() and writeToParcel() are unchanged; the array is still stored as Parcelable[].
Completeness
- Covers the single deserialization site in UsbConfiguration.CREATOR; element type is enforced at unparcel time.
- setInterfaces(@NonNull Parcelable[]) still accepts any Parcelable[] from in-process callers (documented as 'Only used by UsbService implementation'); the fix addresses the Parcel path only.
- The material shows only UsbConfiguration.java; whether other USB Parcelables use typed reads is not shown.
Behavior changes
- Unparceling a UsbConfiguration whose interfaces array contains a Parcelable that is not a UsbInterface now fails with an exception in createFromParcel instead of producing an object whose getInterface() cast would fail later.
- No change for well-formed Parcels written by writeToParcel().
Per major
- Android 14: same fix: commit d8d48d8689f8 in android-security-14.0.0_r2 (cherry-picked from 85d7e6712a9e / 2c9931533cf8, Change-Id I2917c8331b6d56caaa9a6479bcd9a2d089f5f503); patched region present at android-security-14.0.0_r29 (6/7 lines).
- Android 15: not affected (not listed by the bulletin); patched region present at android-security-15.0.0_r17 (6/7 lines).
- Android 16: not affected (not listed by the bulletin); patched region present at android-security-16.0.0_r8 (6/7 lines).
- Android 17: not affected (not listed by the bulletin); patched region present at android-security-17.0.0_r1 (6/7 lines).
Unknowns
- Which IPC path or caller delivers an attacker-controlled UsbConfiguration Parcel (the bulletin only rates it High EoP).
- Whether other USB Parcelable classes in the same package use typed or untyped readParcelableArray; only UsbConfiguration.java is in the material.
- How the fix was applied to Android 11/12/12L/13 branches and whether the typed readParcelableArray overload is available there (only the Android 14 commit is provided).