CVE-2024-49729 AI-generated analysis
platform/system/core, fs_mgr/libdm (device-mapper userspace library)
libdm's DeviceMapper::GetTable now replaces the key field of dm-crypt target parameter strings with the literal "redacted" when the table is queried with DM_STATUS_TABLE_FLAG (i.e. via GetTableInfo), so callers no longer receive the raw encryption key.
Root cause
DeviceMapper::GetTable in fs_mgr/libdm/dm.cpp issues DM_TABLE_STATUS and copies each target's parameter string verbatim into TargetInfo.data. When it is called with DM_STATUS_TABLE_FLAG (GetTableInfo), the returned parameter line for a "crypt" target contains the key as the second space-separated field, which is the field the fix replaces. libdm passed that key to callers of GetTableInfo without redaction.
How the fix works
- fs_mgr/libdm/dm.cpp: adds a free function RedactTableInfo(const struct dm_target_spec& spec, std::string* data). If DeviceMapper::GetTargetType(spec) == "crypt", it splits data on spaces and returns early if there are fewer than 2 fields. Otherwise it sets parts[1] (the key field) to "redacted" and joins the string again.
- fs_mgr/libdm/dm.cpp: DeviceMapper::GetTable builds the per-target data string, then calls RedactTableInfo(*spec, &data) before table->emplace_back(*spec, data). The call happens only when (flags & DM_STATUS_TABLE_FLAG) is set, which is the path GetTableInfo uses. GetTableStatus (flags == 0) is unchanged.
- fs_mgr/libdm/dm_test.cpp: the new test DmTest.RedactDmCrypt creates a loop-backed DmTargetCrypt device with a known key, calls GetTableInfo, and asserts that the key string is absent from targets[0].data.
Completeness
- Covers only targets whose type string is exactly "crypt". This change redacts no other target type.
- Redacts only the second space-separated field (parts[1]) of the crypt parameter line. All other fields are returned unchanged.
- Redaction runs only when DM_STATUS_TABLE_FLAG is set in flags. The status path (GetTableStatus, flags 0) is not redacted.
- Redaction happens in the libdm client library, not in the kernel. This fix does not cover a process that issues DM_TABLE_STATUS directly without libdm.
- Per the per-major facts, both patched hunks (RedactTableInfo and its call site in GetTable) are present at android-security-14.0.0_r29.
Behavior changes
- For crypt targets, DeviceMapper::GetTableInfo now returns the string "redacted" in place of the key field. A consumer that read the key from GetTableInfo results will no longer get it.
- Return values and error handling do not change. The function still succeeds and returns all targets.
- New libdm_test case RedactDmCrypt.
Per major
- Android 14: same fix: commit 370beea3852b in android-security-14.0.0_r17 (cherry-pick of bc067ef9f0408f3b7c4f5dcae3b6aec51f386e4d); 8/8 patched lines present at android-security-14.0.0_r29.
- Android 15: same fix: commit a1b00e3f3412 in android-security-15.0.0_r5. The code change is identical, with different line offsets (dm.cpp @@ -551 and -589; the dm_test.cpp test is appended after the ThinProvisioning test). 8/8 lines present at android-security-15.0.0_r17.
- Android 16: not affected (not listed by the bulletin); the patched region is present (8/8 lines) at android-security-16.0.0_r8.
- Android 17: not affected (not listed by the bulletin); fs_mgr/libdm/dm.cpp and dm_test.cpp are absent at android-security-17.0.0_r1.
Unknowns
- Which caller or interface actually exposed the GetTableInfo output to a less-privileged party. The material does not identify the leak sink.
- Whether other device-mapper target types that carry secrets exist on affected builds. The material only shows handling for "crypt".
- What happened to the libdm code on Android 17, where the patched files are absent.
- The material does not include the fix commits for Android 12, 12L and 13.