CVE-2024-40674 AI-generated analysis
platform/packages/modules/Wifi, WifiConfiguration validation (service/java/com/android/server/wifi/WifiConfigurationUtil.java)
Adds a maximum length check (32 characters plus the two enclosing quotes) for quoted plaintext SSIDs in WifiConfigurationUtil.validateSsid, which previously only length-checked unquoted hex SSIDs.
Root cause
WifiConfigurationUtil.validateSsid only enforced an upper length bound for unquoted (hex) SSIDs: `if (!ssid.startsWith("\"") && ssid.length() > SSID_HEX_MAX_LEN)`. Quoted plaintext SSIDs (strings starting with `"`) had no upper length check in this code, so a caller could set an arbitrarily long SSID in a WifiConfiguration that passed validate(). The constants SSID_UTF_8_MIN_LEN and SSID_UTF_8_MAX_LEN existed but were not used in that branch (the diff removes them). The bulletin rates the impact as DoS; the material does not show which downstream consumer fails on an over-long SSID.
How the fix works
- service/java/com/android/server/wifi/WifiConfigurationUtil.java:validateSsid: the single hex-only condition is split into two branches. If ssid.startsWith("\""), the method now returns false with log 'validateSsid failed: plaintext ssid ... longer than 32 chars' when ssid.length() > SSID_PLAINTEXT_MAX_LEN (new constant, 32 + ENCLOSING_QUOTES_LEN = 34). Otherwise the pre-existing hex check (ssid.length() > SSID_HEX_MAX_LEN = 64) is kept unchanged.
- Constants cleanup in the same file: SSID_UTF_8_MIN_LEN, SSID_UTF_8_MAX_LEN and SSID_HEX_MIN_LEN are removed; SSID_PLAINTEXT_MAX_LEN is introduced. SSID_HEX_MAX_LEN is retained.
- service/tests/wifitests/src/com/android/server/wifi/WifiConfigurationUtilTest.java: renames testValidateNegativeCases_MalformedAsciiSsidString to testValidateNegativeCases_MalformedPlaintextSsidString and adds testValidateNegativeCases_TooLongPlaintextSsidString, which asserts that a quoted 33-character SSID fails validate(config, SUPPORTED_FEATURES_ALL, VALIDATE_FOR_ADD).
Completeness
- Covers both SSID encodings handled by validateSsid: quoted plaintext (new 34-char cap including quotes) and unquoted hex (existing 64-char cap).
- The new check counts Java String characters (ssid.length()), not encoded bytes; the commit message justifies the 32 limit by the minimum of 1 byte per character for any SSID encoding. A quoted SSID of up to 32 multi-byte characters still passes this check; whether the subsequent WifiSsid parsing (the `WifiSsid wifiSsid; try {` block immediately after) enforces the 32-byte limit is not shown in the material.
- The check applies only to code paths that go through WifiConfigurationUtil.validate/validateSsid; SSIDs set via other entry points that do not call this validator are not affected by this change (none are shown in the material).
Behavior changes
- WifiConfigurationUtil.validate now returns false (with an error log) for quoted plaintext SSIDs longer than 32 characters (34 including quotes); such configurations are rejected where they were previously accepted.
- Log message text for the plaintext case: 'validateSsid failed: plaintext ssid <ssid> longer than 32 chars'.
Per major
- Android 14: same fix: commit debc548ac085 in android-security-14.0.0_r13 (cherry-pick of 4a7564305147); at android-security-14.0.0_r29, 5/8 lines of the patched region are present, and the shown code contains the SSID_PLAINTEXT_MAX_LEN constant.
- Android 15: not affected per the bulletin; at android-security-15.0.0_r17, 5/8 lines of the patched region are present.
- Android 16: not affected per the bulletin; at android-security-16.0.0_r8, 5/8 lines of the patched region are present.
- Android 17: not affected per the bulletin; at android-security-17.0.0_r1, 5/8 lines of the patched region are present.
Unknowns
- Which downstream component fails (and how) when an over-long plaintext SSID is accepted; the bulletin only gives the type as DoS.
- Whether the WifiSsid parsing after the new check enforces the 32-byte limit for multi-byte UTF-8 plaintext SSIDs.
- The concrete external callers (Binder entry points) that route into WifiConfigurationUtil.validate and their permission requirements.
- Which 3 of the 8 patched-region lines are absent at the latest tags of 14 through 17.
- When the upstream commit 4a7564305147 landed in the 15+ branches.