CVE-2023-45773 AI-generated analysis
platform/packages/modules/Bluetooth, BT stack BLE GAP periodic advertising sync (system/stack/btm/btm_ble_gap.cc)
Adds MAX_SYNC_TRANSACTION sentinel checks before indexing the periodic-sync tables (p_sync[] and sync_transfer[]) in five functions of system/stack/btm/btm_ble_gap.cc, so a failed index lookup no longer leads to an out-of-bounds access.
Root cause
The helpers btm_ble_get_psync_index(), btm_ble_get_free_psync_index() and btm_ble_get_free_sync_transfer_index() can return MAX_SYNC_TRANSACTION when no matching or free slot is found (the fix treats that value as the failure case). Several callers used the return value directly to index btm_ble_pa_sync_cb.p_sync[] or btm_ble_pa_sync_cb.sync_transfer[]. btm_ble_start_sync_request then wrote p->sync_state, and the sync_transfer paths wrote in_use, through the resulting pointer. btm_ble_start_sync_request and btm_ble_start_sync_timeout had no check at all. BTM_BlePeriodicSyncTransfer and BTM_BlePeriodicSyncSetInfo had no check after getting a free sync_transfer index. BTM_BleStartPeriodicSync already had the check, but formed the element pointer before it.
How the fix works
- btm_ble_gap.cc:btm_ble_start_sync_request: after btm_ble_get_psync_index(sid, addr), if index == MAX_SYNC_TRANSACTION, log an error and return before computing &btm_ble_pa_sync_cb.p_sync[index] and setting p->sync_state. This also skips PeriodicScanStart and the sync timeout alarm.
- btm_ble_gap.cc:btm_ble_start_sync_timeout: same check after btm_ble_get_psync_index(adv_sid, address). On MAX_SYNC_TRANSACTION it logs and returns before p_sync[index] is used.
- btm_ble_gap.cc:BTM_BleStartPeriodicSync: moves the computation of p = &btm_ble_pa_sync_cb.p_sync[index] to after the existing index == MAX_SYNC_TRANSACTION check (which already ran syncCb with BTM_NO_RESOURCES and returned). Behavior is unchanged; the pointer is just no longer formed from the sentinel.
- btm_ble_gap.cc:BTM_BlePeriodicSyncTransfer: after btm_ble_get_free_sync_transfer_index(), if index == MAX_SYNC_TRANSACTION, log via BTM_TRACE_ERROR, run cb with BTM_ILLEGAL_VALUE and addr, and return before touching sync_transfer[index].
- btm_ble_gap.cc:BTM_BlePeriodicSyncSetInfo: the same check and BTM_ILLEGAL_VALUE callback before indexing sync_transfer[index].
Completeness
- All five sites in the diff that index p_sync[] or sync_transfer[] with a value from the three lookup helpers now reject the MAX_SYNC_TRANSACTION sentinel before any dereference.
- The fix is defensive at the call sites only; the helpers still return MAX_SYNC_TRANSACTION as the not-found value. Any other caller of those helpers would need the same check. The material does not show other callers, so their status is not established.
- In btm_ble_start_sync_request, the early return skips PeriodicScanStart and the timeout alarm, and the diff adds no callback or cleanup for that case.
Behavior changes
- BTM_BlePeriodicSyncTransfer and BTM_BlePeriodicSyncSetInfo now invoke the caller's callback with BTM_ILLEGAL_VALUE when no free sync_transfer slot is available, instead of proceeding.
- btm_ble_start_sync_request returns early with LOG_ERROR when no p_sync entry matches sid/addr. In that case the periodic scan is not started and the SYNC_TIMEOUT alarm is not armed.
- btm_ble_start_sync_timeout returns early with LOG_ERROR when the entry cannot be found, skipping the rest of the timeout handling.
- BTM_BleStartPeriodicSync: no observable change (the existing BTM_NO_RESOURCES path is kept; only the pointer computation is reordered).
Per major
- Android 14: same fix: commit 397c1e928552 (Change-Id I4c8ec50c15e2727839a49da0e582164557bcd38a) in android-security-14.0.0_r3; all 8 patched lines present at android-security-14.0.0_r29.
- Android 15: not affected (not listed by the bulletin); the patched region is present (8/8 lines) at android-security-15.0.0_r17.
- Android 16: not affected (not listed by the bulletin); the patched region is present (8/8 lines) at android-security-16.0.0_r8.
- Android 17: not affected (not listed by the bulletin); 0/8 patched lines found at android-security-17.0.0_r1, so the code region appears to have been removed or restructured. The material does not show the replacement code.
Unknowns
- Whether other callers of btm_ble_get_psync_index / btm_ble_get_free_psync_index / btm_ble_get_free_sync_transfer_index exist that this diff does not cover.
- Who calls btm_ble_start_sync_request and btm_ble_start_sync_timeout (the index search returned no callers).
- The concrete trigger, and why the bulletin classifies it as EoP.
- How the Android 13 branch was patched (no 13 commit in the material).
- What replaced this code in Android 17, where the patched region is absent.