CVE-2024-43083 AI-generated analysis

platform/packages/modules/Wifi, WifiService (WifiConfigurationUtil / WifiServiceImpl.addOrUpdateNetwork)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

Adds input validation in WifiConfigurationUtil.validate() for many previously unchecked WifiConfiguration fields (dhcpServer, defaultGwMacAddress, security params list, Passpoint fields, NetworkSelectionStatus, WEP keys on non-WEP configs, DPP key byte arrays) and makes WifiServiceImpl.addOrUpdateNetwork reject a BSSID allowlist from callers that are not privileged, system or admin.

Root cause

Before the fix, the visible part of WifiConfigurationUtil.validate() checked SSID, BSSID, bit sets, key management, WEP keys (only when the security type was WEP), a PSK-type check and IP configuration. These caller-controlled WifiConfiguration fields were not checked there: dhcpServer, defaultGwMacAddress, the SecurityParams list, FQDN, providerFriendlyName, roamingConsortiumIds, updateIdentifier, NetworkSelectionStatus connectChoice and BSSID, wepKeys on non-WEP configs, and the DPP connector, CSign, private EC and net access key byte arrays. Separately, any app that passed addOrUpdateNetwork's existing checks could also supply a BSSID allowlist. The bulletin classifies the impact as DoS. The material does not show which consumer fails on the oversized or malformed values.

How the fix works

• service/java/com/android/server/wifi/WifiConfigurationUtil.java:validate(): config.dhcpServer and config.defaultGwMacAddress are now passed through validateBssid() alongside config.BSSID.
• WifiConfigurationUtil.java:validate() -> new validateSecurityParameters(config.getSecurityParamsList()): rejects any SecurityParams whose getSecurityType() is < 0 or > SECURITY_TYPE_NUM, and rejects duplicate security types in the list.
• WifiConfigurationUtil.java:validate() -> new validatePasspoint(config): FQDN and providerFriendlyName are limited to PasspointConfiguration.MAX_STRING_LENGTH via validateStringField(). roamingConsortiumIds is limited to MAX_NUMBER_OF_OI entries, each in [0, MAX_OI_VALUE] (validateRoamingConsortiumIds). updateIdentifier must be empty or parse with Integer.valueOf (validateUpdateIdentifier).
• WifiConfigurationUtil.java:validate() -> new validateNetworkSelectionStatus(config.getNetworkSelectionStatus()): returns false if status is null. connectChoice is limited to the new local MAX_STRING_LENGTH (512), and getNetworkSelectionBSSID() must pass validateBssid().
• WifiConfigurationUtil.java:validate(): WEP key handling is restructured. For WEP security types the previous check is kept (wepKeys != null -> validateWepKeys(wepKeys, wepTxKeyIndex, isAdd)). For non-WEP security types, validateWepKeys(config.wepKeys, config.wepTxKeyIndex, false) is now always called (test testWepKeyOnNonWepConfig).
• WifiConfigurationUtil.java:validate(): after validateIpConfiguration, rejects the config if getDppConnector(), getDppCSignKey(), getDppPrivateEcKey() or getDppNetAccessKey() is longer than PasspointConfiguration.MAX_URL_BYTES.
• service/java/com/android/server/wifi/WifiServiceImpl.java:addOrUpdateNetwork(): after computing isAdmin/isSystem/isPrivileged, returns -1 (with a log line) when the caller is not privileged, system or admin and config.getBssidAllowlistInternal() != null. This check runs before the isTargetSdkLessThanQOrPrivileged gate.
• Tests: WifiConfigurationUtilTest adds testWepKeyOnNonWepConfig, testInvalidFqdnAndFriendlyName, testInvalidDhcpAndGtw, testInvalidSecurityParameter, testInvalidUserConnectChoice and testInvalidDppConfig. WifiServiceImplTest adds testAddOrUpdateNetworkWithBssidAllowListIsNotAllowedForAppsNotPrivileged.

Completeness

• Covers: dhcpServer, defaultGwMacAddress, SecurityParams list bounds and uniqueness, FQDN, providerFriendlyName, roamingConsortiumIds, updateIdentifier, NetworkSelectionStatus connectChoice and BSSID, WEP keys on non-WEP configs, the four DPP byte arrays, and the BSSID allowlist privilege gate in addOrUpdateNetwork.
• Leaves out: WifiEnterpriseConfig fields are still not validated here. The comment 'TBD: Validate some enterprise params as well in the future here' remains in validate().
• The DPP length check only bounds the four getters listed. Other WifiConfiguration string or array fields not named in the diff are unchanged.
• The BSSID allowlist gate is only added in WifiServiceImpl.addOrUpdateNetwork. The material does not show whether other entry points that accept a WifiConfiguration apply the same gate.
• All field checks are inside WifiConfigurationUtil.validate(), so any path that stores a WifiConfiguration without calling validate() is not covered by this change. The material does not show the callers of validate().

Behavior changes

• validate() now returns false (so add or update fails) for configs with: FQDN or providerFriendlyName longer than PasspointConfiguration.MAX_STRING_LENGTH; connectChoice longer than 512 chars; invalid dhcpServer, defaultGwMacAddress or networkSelectionBSSID strings; too many or out-of-range roamingConsortiumIds; a non-numeric updateIdentifier; out-of-range or duplicate security types; WEP keys on non-WEP configs that fail validateWepKeys; or DPP key arrays longer than MAX_URL_BYTES.
• validate() now returns false when getNetworkSelectionStatus() is null.
• addOrUpdateNetwork returns -1 and logs 'addOrUpdateNetwork with allow bssid list is not allowed' when a caller that is not privileged, system or admin supplies a BSSID allowlist. Per the new test, this includes an empty list.

Per major

• Android 14: same fix: commit 62f61e19524e in android-security-14.0.0_r14 (one commit made by chained internal cherry-picks, Change-Id I8998340ae557660036895dd906808d682b83c6f0). At android-security-14.0.0_r29, 8/8 lines of the patched region are present.
• Android 15: not affected (the bulletin does not list it). The patched region is fully present (8/8) at android-security-15.0.0_r17.
• Android 16: not affected (the bulletin does not list it). The patched region is fully present (8/8) at android-security-16.0.0_r8.
• Android 17: not affected (the bulletin does not list it). The patched region is fully present (8/8) at android-security-17.0.0_r1.

Unknowns

• The material does not show the exact consumer that failed on the unvalidated fields (the DoS mechanism).
• The material does not show which call sites invoke WifiConfigurationUtil.validate(), and therefore which binder entry points beyond addOrUpdateNetwork are covered.
• The per-major facts do not cover the fix status in Android 12, 12L and 13, which the bulletin lists as affected.
• The material does not show the semantics of validateWepKeys when called with isAdd=false for non-WEP configs.
• The full pre-fix contents of validate() (for example SAE or enterprise checks) are not shown in the diff context.

Back to November 2024 · Findings