CVE-2024-34719 AI-generated analysis
platform/packages/modules/Bluetooth, Bluetooth app permission helpers (android/app/src/com/android/bluetooth/Utils.java)
Adds Objects.requireNonNull() on the caller-supplied AttributionSource in four Bluetooth permission-check helpers in Utils.java, so a null AttributionSource can no longer produce a stub attribution chain that checks only Bluetooth's own permissions. It also updates UtilsTest to stop passing null.
Root cause
Several Bluetooth permission helpers in Utils.java build an attribution chain with new AttributionSource.Builder(context.getAttributionSource()).setNext(attributionSource).build() and then query PermissionManager. checkPermissionForDataDelivery does this with checkPermissionForDataDeliveryFromDataSource(), per context. The attributionSource parameter comes from the Binder caller and was not null-checked. Per the commit message, when a caller passed null the result was a stub attribution chain that did not properly check the caller's permissions, so the checks validated only Bluetooth's own permissions. This allowed permission bypasses on multiple Binder-exposed Bluetooth methods.
How the fix works
- android/app/src/com/android/bluetooth/Utils.java:checkPermissionForDataDelivery (hunk at ~line 534): .setNext(attributionSource) is replaced with .setNext(Objects.requireNonNull(attributionSource)). A null caller attribution source now throws NullPointerException before any PermissionManager query, instead of building the stub chain.
- android/app/src/com/android/bluetooth/Utils.java: the same one-line change is made in three more helpers (hunks at ~lines 809, 843 and 881). The hunk headers do not show their function names, but the test changes point to the location helpers checkCallerHasCoarseLocation and checkCallerHasCoarseOrFineLocation being among them. Each previously did Builder(context.getAttributionSource()).setNext(attributionSource) and now requires attributionSource to be non-null.
- android/app/tests/unit/src/com/android/bluetooth/UtilsTest.java: checkCallerHasCoarseLocation_doesNotCrash and checkCallerHasCoarseOrFineLocation_doesNotCrash previously called the helpers with a null AttributionSource. They now pass context.getAttributionSource().
- The diff adds no new imports, so java.util.Objects is presumably already imported in Utils.java on this branch.
Completeness
- Covers the four Builder(...).setNext(attributionSource) sites in Utils.java visible in the diff, and all four now reject null. At android-security-14.0.0_r29 all 8 lines of the patched region are present.
- The fix only rejects null. It does not check that a non-null AttributionSource belongs to the Binder caller: in all four hunks, attributionSource.enforceCallingUid() is still commented out under the STOPSHIP(b/188391719) note.
- checkPermissionForPreflight (Utils.java, shown in context) uses only context.getAttributionSource() and takes no caller attribution source. It is unchanged and does not follow the same pattern.
- Code paths outside Utils.java that build an attribution chain from a caller-supplied AttributionSource are not shown in the material, and this commit does not touch them.
Behavior changes
- Calling any of the four patched helpers with a null AttributionSource now throws NullPointerException (from Objects.requireNonNull). Before the fix, the result was computed against a stub chain carrying Bluetooth's own identity.
- For Binder callers, that NullPointerException is raised in the Bluetooth process while it handles the transaction. Binder propagates NullPointerException back to the caller as an exception (general platform knowledge).
- Permission checks with a non-null AttributionSource are unchanged in the diff.
- The unit tests no longer pass null; they use the test context's own AttributionSource.
Per major
- Android 14: same fix: commit b0e4375577ba landed in android-security-14.0.0_r11 (resolved by bug_id). At android-security-14.0.0_r29 the patched region is fully present (8/8 lines).
- Android 15: not affected per the bulletin (not listed). At android-security-15.0.0_r17, 6/8 lines of the patched region are present. The material does not show which lines match or whether the requireNonNull checks are there.
- Android 16: not affected per the bulletin (not listed). At android-security-16.0.0_r8, 5/8 lines of the patched region are present. The material does not show which lines match.
- Android 17: not affected per the bulletin (not listed). At android-security-17.0.0_r1, 0/8 lines of the patched region are present. The material does not show where, or whether, the equivalent code exists.
Unknowns
- The hunk headers do not show the names of the three helpers patched at ~lines 809, 843 and 881. The test diff implies that checkCallerHasCoarseLocation and checkCallerHasCoarseOrFineLocation are among them.
- The material does not list which Binder-exposed Bluetooth methods the researcher used; the commit says only 'multiple methods'.
- Whether equivalent fixes shipped for Android 12, 12L and 13, and in which commits, is not shown.
- Which lines of the patched region match in Android 15 and 16, and where the equivalent code lives in Android 17, is not shown.