CVE-2023-45866 AI-generated analysis

platform/packages/modules/Bluetooth, BR/EDR security manager (system/stack/btm/btm_sec.cc)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

The Bluetooth BTM security manager (system/stack/btm/btm_sec.cc) now rejects remote-initiated access to L2CAP and RFCOMM services that require incoming authentication when the peer is authenticated through a temporary bond, returning BTM_FAILED_ON_SECURITY. Related commits stop forcing the authenticate bit for SM4 peers and start authentication whenever encryption is required.

Root cause

In btm_sec.cc the grant paths of btm_sec_l2cap_access_req_by_requirement (rc == BTM_SUCCESS branch, which called p_callback with a hardcoded BTM_SUCCESS), btm_sec_mx_access_request (rc == BTM_SUCCESS branch) and btm_sec_execute_procedure (the 'All required security procedures already established' step, which clears the AUTHENTICATE/ENCRYPT bits) did not consider whether the authenticated peer's bond was temporary (is_bond_type_temporary()). So a remote-initiated request for a service whose security_required includes BTM_SEC_IN_AUTHENTICATE could be granted for a temp-bonded, authenticated peer.

How the fix works

• Commit 09b33986b3f1 ([1]) btm_sec.cc: adds static helper access_secure_service_from_temp_bond(p_dev_rec, locally_initiated, security_req). It returns true when the request is not locally initiated, security_req has BTM_SEC_IN_AUTHENTICATE, p_dev_rec->is_device_authenticated() is true and p_dev_rec->is_bond_type_temporary() is true.
• Commit 09b33986b3f1 btm_sec.cc:btm_sec_l2cap_access_req_by_requirement: in the rc == BTM_SUCCESS path, the helper is evaluated with is_originator and security_required. On a match rc becomes BTM_FAILED_ON_SECURITY, which is now passed to p_callback and returned instead of the hardcoded BTM_SUCCESS.
• Commit 09b33986b3f1 btm_sec.cc:btm_sec_execute_procedure: before the 'All required security procedures already established' step that clears the AUTHENTICATE/ENCRYPT bits from p_dev_rec->security_required, the helper is evaluated with p_dev_rec->IsLocallyInitiated() and p_dev_rec->security_required. On a match the function returns BTM_FAILED_ON_SECURITY.
• Commit d7e833a2ce6b ([2]) btm_sec.cc:btm_sec_mx_access_request (RFCOMM multiplexer path): in the rc == BTM_SUCCESS branch the same helper is applied, and rc is set to BTM_FAILED_ON_SECURITY before p_callback is invoked.
• Commit 1efe6c2e677f ([3], citing Nearby regression bug 298539299) btm_sec.cc:btm_sec_l2cap_access_req_by_requirement: for SM4-to-SM4 links in BTM_SEC_MODE_SP/BTM_SEC_MODE_SC, BTM_SEC_OUT_AUTHENTICATE / BTM_SEC_IN_AUTHENTICATE are no longer forced into security_required. Only BTM_SEC_OUT_ENCRYPT / BTM_SEC_IN_ENCRYPT are added. Because the new rejection keys on BTM_SEC_IN_AUTHENTICATE, this narrows the rejection to services that require authentication (commit body: 'Allow access to rfcomm PSM by default').
• Commit 9e02767767c2 (unnumbered, citing regression bugs 299570702/299561281) btm_sec.cc:btm_sec_execute_procedure: when the BR/EDR link is not BTM_SEC_AUTHENTICATED, start_auth is now set if security_required has either the AUTHENTICATE bit or the ENCRYPT bit for the relevant direction, so encryption-only requirements also trigger authentication.

Completeness

• The temp-bond rejection is applied on three grant paths: the rc == BTM_SUCCESS path of btm_sec_l2cap_access_req_by_requirement, the 'already established' path of btm_sec_execute_procedure, and the rc == BTM_SUCCESS branch of btm_sec_mx_access_request (RFCOMM).
• Only remote-initiated (acceptor) requests are rejected. Locally initiated requests make access_secure_service_from_temp_bond return false.
• The check keys on BTM_SEC_IN_AUTHENTICATE only. With 1efe6c2e677f applied, encryption-only incoming requirements are not caught by the temp-bond check. 9e02767767c2 makes such requirements start authentication in btm_sec_execute_procedure when the link is not yet authenticated.
• The material does not show whether btm_sec_l2cap_access_req_by_requirement or btm_sec_mx_access_request have other early-success returns outside the diffed hunks, and it shows no change to LE (SMP) paths.

Behavior changes

• Service access callbacks can now receive BTM_FAILED_ON_SECURITY instead of BTM_SUCCESS for remote-initiated access from a temp-bonded, authenticated peer to a service requiring BTM_SEC_IN_AUTHENTICATE. btm_sec_execute_procedure returns BTM_FAILED_ON_SECURITY in the same case.
• New LOG_ERROR lines: 'Trying to access a secure service from a temp bonding, rejecting' and 'Trying to access a secure rfcomm service from a temp bonding, reject'.
• SM4-to-SM4 links in SP/SC mode no longer get BTM_SEC_OUT_AUTHENTICATE / BTM_SEC_IN_AUTHENTICATE forced into security_required in btm_sec_l2cap_access_req_by_requirement. Only the ENCRYPT bits are added.
• btm_sec_execute_procedure now starts authentication on an unauthenticated BR/EDR link when encryption is required, not only when authentication is required.

Per major

• Android 14: Same fix: four commits (09b33986b3f1, d7e833a2ce6b, 1efe6c2e677f, 9e02767767c2) in android-security-14.0.0_r3, all in system/stack/btm/btm_sec.cc. At android-security-14.0.0_r29, 5/5 lines of the patched region are present.
• Android 15: Not affected per the bulletin. At android-security-15.0.0_r17, 6/8 lines of the patched region are present. The material does not show whether an equivalent check exists.
• Android 16: Not affected per the bulletin. At android-security-16.0.0_r8, 3/8 lines of the patched region are present. The material does not show whether an equivalent check exists.
• Android 17: Not affected per the bulletin. At android-security-17.0.0_r1, 2/8 lines of the patched region are present. The material does not show whether an equivalent check exists.

Unknowns

• The material does not describe the concrete trigger or which profile/service the EoP targets. It shows only the code-level condition (temp bond plus an incoming authentication requirement).
• The relative order of 9e02767767c2 among the numbered commits is not stated.
• Whether an equivalent check exists in Android 15/16/17, where the patched region only partially matches.
• Whether btm_sec_l2cap_access_req_by_requirement or btm_sec_mx_access_request have other early-success returns outside the diffed hunks.

Back to December 2023 · Findings