CVE-2023-45775 AI-generated analysis
platform/packages/modules/Bluetooth, system/bta/le_audio/broadcaster (LE Audio broadcaster)
Adds length checks (size >= 2) on the StreamingAudioContext LTV value in LeAudioBroadcasterImpl::CreateAudioBroadcast before it is written with UINT16_TO_STREAM and read with STREAM_TO_UINT16, returning early on short values.
Root cause
In system/bta/le_audio/broadcaster/broadcaster.cc, LeAudioBroadcasterImpl::CreateAudioBroadcast parses the subgroup metadata with LeAudioLtvMap::Parse and looks up the kLeAudioMetadataTypeStreamingAudioContext entry with ltv.Find(). The code then took the raw pointer to the entry's value (stream_context_vec.value().data()) and always treated it as a 2-byte field without checking its length. UINT16_TO_STREAM wrote two bytes into it on the PTS multiple-contexts path, and STREAM_TO_UINT16 read two bytes from it on every call. A value shorter than 2 bytes made the write and the read go past the end of the vector's storage.
How the fix works
- system/bta/le_audio/broadcaster/broadcaster.cc : LeAudioBroadcasterImpl::CreateAudioBroadcast, PTS path (inside get_pts_force_le_audio_multiple_contexts_metadata()): after ltv.Find(kLeAudioMetadataTypeStreamingAudioContext) succeeds, the fix adds 'if (stream_context_vec.value().size() < 2) { LOG_ERROR(...); return; }' before UINT16_TO_STREAM(pp, context_type.value()). This prevents the out-of-bounds write.
- Same file and function, unconditional path: the fix adds the same size < 2 check before STREAM_TO_UINT16(context_type.value_ref(), pp). This prevents the out-of-bounds read.
- Both checks return from the function, which stops the whole operation instead of skipping the entry. The commit makes no other change to validation or to the parser.
Completeness
- Covers both uses of the StreamingAudioContext value in the patched function: the write (UINT16_TO_STREAM) under the PTS flag and the read (STREAM_TO_UINT16) on the normal path.
- Does not change LeAudioLtvMap::Parse or ltv.Find. Other consumers of LTV values that assume a fixed length are therefore not covered by this commit, but the material does not show any.
- The android-security-14.0.0_r29 excerpt shows an equivalent size < 2 check in a broadcast_id-keyed path of the same class (it uses broadcasts_[broadcast_id]->GetCodecConfig()). The log text differs and the check comes after 'auto pp = ...data()'. The material does not show whether this is the same function after refactoring or a sibling path patched separately. Taking the pointer before the check is harmless because the pointer is not dereferenced until after the check.
Behavior changes
- If a StreamingAudioContext LTV value in the subgroup metadata is shorter than 2 bytes, the function now logs 'kLeAudioMetadataTypeStreamingAudioContext size < 2' and returns early. Before the fix it went on to access memory out of bounds.
- The diff adds no new return code or callback. The caller only sees that the operation does not complete.
Per major
- Android 14: same fix: commit 8e3b3fc918b3 in android-security-14.0.0_r3 (cherry-pick of internal 5f9059acdfed, Change-Id Ia8e9c3a3e534f419b6bd6c902a35d2caf4c7727b). At android-security-14.0.0_r29 the patched region is fully present (8/8 lines); in the shown excerpt the log text and the position of the check differ slightly.
- Android 15: not affected per the bulletin. android-security-15.0.0_r17 carries 5/8 lines of the patched region; the material does not show the exact form of the code.
- Android 16: not affected per the bulletin. android-security-16.0.0_r8 carries 6/8 lines of the patched region; the exact form is not shown.
- Android 17: not affected per the bulletin. android-security-17.0.0_r1 carries 6/8 lines of the patched region; the exact form is not shown.
Unknowns
- Which caller or IPC surface a party uses to reach CreateAudioBroadcast with controlled metadata is not shown in the material.
- Whether LeAudioLtvMap::Parse enforces any per-type value length is not shown.
- Whether the r29 excerpt (broadcast_id-keyed, broadcasts_[broadcast_id]) is CreateAudioBroadcast after refactoring or a sibling function fixed by another change is not shown.
- The precise state of the code in the Android 15/16/17 security tags is not shown beyond partial line-match counts.