CVE-2024-23717 AI-generated analysis
platform/packages/modules/Bluetooth, system/stack/btm (BTM security manager, btm_sec.cc)
Removes the p_dev_rec->is_device_authenticated() conjunct from access_secure_service_from_temp_bond() in system/stack/btm/btm_sec.cc. The helper now flags any remote-initiated access to a service requiring incoming authentication from a temporarily bonded device, not only when the device record is already marked authenticated.
Root cause
access_secure_service_from_temp_bond() is the utility that tests whether an access to a secure service from a temporary bond is happening. Before the fix it returned true only when all four of these held: the request was not locally initiated, security_req had BTM_SEC_IN_AUTHENTICATE, p_dev_rec->is_device_authenticated() was true, and p_dev_rec->is_bond_type_temporary() was true. Because of the is_device_authenticated() conjunct, the helper did not detect a temporarily bonded remote device whose record was not marked authenticated. The commit describes this as a security bypass, and the bulletin rates it Critical EoP.
How the fix works
- system/stack/btm/btm_sec.cc:access_secure_service_from_temp_bond: deletes `p_dev_rec->is_device_authenticated() &&` from the return expression. The predicate becomes `!locally_initiated && (security_req & BTM_SEC_IN_AUTHENTICATE) && p_dev_rec->is_bond_type_temporary()`.
- Effect: the helper now returns true for every remote-initiated request that requires incoming authentication on a device whose bond type is temporary, whatever its authenticated state.
Completeness
- The fix changes only the predicate in access_secure_service_from_temp_bond(). The function is static, so its callers are in btm_sec.cc. They are not shown in the material and are not changed by this commit.
- The check is still limited to !locally_initiated and BTM_SEC_IN_AUTHENTICATE. As before, this helper does not evaluate locally initiated connections or requirements other than incoming authentication.
- The commit does not change how is_bond_type_temporary() is set. The fix depends on the bond type being recorded correctly as temporary.
Behavior changes
- The helper returns true in more cases: it now includes temporarily bonded, remote-initiated, IN_AUTHENTICATE requests where the device record is not flagged authenticated. The caller-side effect, most likely a stricter denial of access, is not shown in the material.
- The diff adds no new APIs or error codes.
Per major
- Android 14: Same fix: commit 618374db66c0 in android-security-14.0.0_r6 (cherry-pick of internal 62944f39f502, Change-Id I48df2c2d77810077e97d4131540277273d441998). At android-security-14.0.0_r29 the function body shows the fixed predicate without is_device_authenticated(), and 5/6 lines of the patched region are present.
- Android 15: Not affected per the bulletin. At android-security-15.0.0_r17, 4/6 lines of the patched region are present. The code is not shown, so check that is_device_authenticated() is absent from the predicate.
- Android 16: Not affected per the bulletin. At android-security-16.0.0_r8, 4/6 lines of the patched region are present. Check the predicate as for 15.
- Android 17: Not affected per the bulletin. At android-security-17.0.0_r1, 4/6 lines of the patched region are present. Check the predicate as for 15.
Unknowns
- The material does not include the call sites of access_secure_service_from_temp_bond() or the action taken when it returns true.
- The material does not show which pairing or bonding flow leaves a temporary bond record without the authenticated flag set.
- The bulletin lists Android 13 as affected, but no Android 13 commit is provided, so it is unknown whether 13 received the same change.
- Why only 4/6 lines of the patched region match on 15, 16 and 17, and what the predicate looks like there.