CVE-2023-45776 AI-generated analysis
platform/packages/modules/Bluetooth, LE Audio broadcaster (system/bta/le_audio/broadcaster/broadcaster.cc, LeAudioBroadcasterImpl)
Adds length checks in LeAudioBroadcasterImpl (system/bta/le_audio/broadcaster/broadcaster.cc) so that the 2-byte StreamingAudioContext LTV value from caller-supplied broadcast subgroup metadata is only read or written when the value vector holds at least 2 bytes.
Root cause
In LeAudioBroadcasterImpl (commit title: CreateAudioBroadcast), each subgroup metadata blob is parsed into an LeAudioLtvMap and the kLeAudioMetadataTypeStreamingAudioContext entry is looked up with ltv.Find. The code then took stream_context_vec.value().data() and, without checking the size, ran UINT16_TO_STREAM (a write, in the PTS multiple-contexts branch) and STREAM_TO_UINT16 (a read, in the general path). Both macros access 2 bytes. If the entry's value was 0 or 1 bytes long, the 2-byte access went beyond the vector's storage: an OOB write at the first site and an OOB read at the second. The fix implies that parsing did not enforce a minimum length for this type.
How the fix works
- system/bta/le_audio/broadcaster/broadcaster.cc, LeAudioBroadcasterImpl (metadata preparation, PTS branch guarded by get_pts_force_le_audio_multiple_contexts_metadata()): before UINT16_TO_STREAM(pp, context_type.value()), checks stream_context_vec.value().size() < 2. If the check fails, it logs 'kLeAudioMetadataTypeStreamingAudioContext size < 2' and returns from the function.
- system/bta/le_audio/broadcaster/broadcaster.cc, LeAudioBroadcasterImpl (same loop, general path): before STREAM_TO_UINT16(context_type.value_ref(), pp), applies the same size() < 2 check with LOG_ERROR and return.
- Both checks sit inside the per-subgroup loop and use return, so a malformed entry in any subgroup ends the whole function. That subgroup is not simply skipped.
Completeness
- Covers both 2-byte accesses on the StreamingAudioContext LTV value in the patched function: the write (PTS branch) and the read (general path).
- The check matches the access size (2 bytes) exactly and is applied to the vector returned by ltv.Find, so it does not depend on parsing having validated lengths for each type.
- The code context at android-security-14.0.0_r29 (lines 271-330) is a function that works on an existing broadcast_id and has the same two access sites. It contains equivalent checks, but with a different log message ('stream_context_vec.value() size < 2') and with pp assigned before the check. The material does not show whether this is the same function after refactoring or a sibling path that was fixed separately.
- This commit does not touch other LTV types that may be read elsewhere in the broadcaster with fixed-size expectations. The material does not show whether any exist.
Behavior changes
- New error path: if the StreamingAudioContext LTV value in any subgroup's metadata is shorter than 2 bytes, the function logs an error and returns early, so the broadcast is not created or configured.
- The diff adds no new callback or error code. It does not show whether the caller is told about the failure.
Per major
- Android 14: same fix: commit 8e3b3fc918b3 in android-security-14.0.0_r3 (cherry-pick of internal commit 5f9059acdfed, Change-Id Ia8e9c3a3e534f419b6bd6c902a35d2caf4c7727b). At android-security-14.0.0_r29 the patched region is fully present (8/8 lines).
- Android 15: not affected per the bulletin. At android-security-15.0.0_r17, 5 of the 8 patched-region lines are present. The material does not show whether the checks are present.
- Android 16: not affected per the bulletin. At android-security-16.0.0_r8, 6 of the 8 patched-region lines are present. The material does not show whether the checks are present.
- Android 17: not affected per the bulletin. At android-security-17.0.0_r1, 6 of the 8 patched-region lines are present. The material does not show whether the checks are present.
Unknowns
- The hunk headers do not give the name of the function that contains the hunks (the commit title says CreateAudioBroadcast). The r29 context shown may be a different function, since it looks up an existing broadcast_id.
- Whether LeAudioLtvMap::Parse checks value lengths per type in any version (the fix implies it did not for this type).
- Whether the caller is notified of the failure after the new early return.
- Which process boundary the attacker-controlled metadata crosses, and what device or feature conditions (e.g. LE Audio broadcast support) are needed. The bulletin only states EoP, High.
- Whether the checks are present at the latest security tags for 15, 16 and 17, given that only part of the patched region matches.