CVE-2025-0079 AI-generated analysis

platform/packages/modules/Bluetooth, system/stack (AVDTP and AVCTP L2CAP channel setup)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

Adds an encryption requirement (BTA_SEC_ENCRYPT / BTM_SEC_OUT_ENCRYPT) next to the existing authentication requirement for the AVDTP and AVCTP L2CAP PSM registrations and outgoing connect requests in the Bluetooth stack.

Root cause

AVCTP (control PSM AVCT_PSM and browsing PSM AVCT_BR_PSM) and AVDTP (AVDT_PSM) registered their PSMs with L2CAP and made outgoing connect requests with only BTA_SEC_AUTHENTICATE (BTM_SEC_OUT_AUTHENTICATE for the outgoing AVDTP request). No encryption flag was set, so the requested security level for these channels did not include encryption. On Android 14, L2CA_Register2 passes sec_level to BTM_SetSecurityLevel (system/stack/l2cap/l2c_api.cc, per index search), so the missing flag affected the registered security level for incoming connections as well as the outgoing requests.

How the fix works

• system/stack/avct/avct_api.cc:AVCT_Register: adds uint16_t sec = BTA_SEC_AUTHENTICATE | BTA_SEC_ENCRYPT and passes it to both L2CA_Register2 calls (AVCT_PSM with avct_l2c_appl, and AVCT_BR_PSM with avct_l2c_br_appl).
• system/stack/avct/avct_lcb_act.cc:avct_lcb_chnl_open: the outgoing L2CA_ConnectReq2 for AVCT_PSM now passes BTA_SEC_AUTHENTICATE | BTA_SEC_ENCRYPT.
• system/stack/avct/avct_bcb_act.cc:avct_bcb_chnl_open: the outgoing L2CA_ConnectReq2 for AVCT_BR_PSM (browsing channel) now passes BTA_SEC_AUTHENTICATE | BTA_SEC_ENCRYPT.
• system/stack/avdt/avdt_api.cc:AVDT_Register: adds uint16_t sec = BTA_SEC_AUTHENTICATE | BTA_SEC_ENCRYPT and passes it to L2CA_Register2 for AVDT_PSM.
• system/stack/avdt/avdt_ad.cc:avdt_ad_open_req: the outgoing L2CA_ConnectReq2 for AVDT_PSM, which handles both signaling and media channel types in the initiator role, now passes BTM_SEC_OUT_AUTHENTICATE | BTM_SEC_OUT_ENCRYPT.
• No new error handling is added. The existing failure paths (lcid == 0 leads to AVCT_LCB_LL_CLOSE_EVT or avdt_ad_tc_close_ind) handle connect request failures as before.

Completeness

• Covers all three PSMs used by AVDTP/AVCTP (AVDT_PSM, AVCT_PSM, AVCT_BR_PSM) on both the acceptor side (PSM registration) and the initiator side (connect requests). This is six call sites in five files.
• avdt_ad_open_req has one L2CA_ConnectReq2 call shared by signaling and media channel types, so this one change covers both.
• The fix only changes the requested security level. It adds no runtime checks in the AVDTP/AVCTP data paths that the link is encrypted, and relies on the L2CAP/BTM security layer to enforce the flags.
• Security levels of other Bluetooth profiles' PSM registrations are outside this commit, and the material does not show them.
• The commit message lists only 'mmm packages/modules/Bluetooth' as the test. No functional test is included.

Behavior changes

• AVDTP (A2DP) and AVCTP (AVRCP control and browsing) L2CAP channels now request encryption as well as authentication, both in the PSM registration (passed to BTM_SetSecurityLevel via L2CA_Register2, per index search) and in outgoing connect requests.
• Expected effect: peers that cannot meet the encryption requirement may no longer be able to set up these channels. The material does not show the enforcement behavior.

Per major

• Android 14: same fix: commit 6893799a69f2 in android-security-14.0.0_r18 (security-branch backport of b/345258562, Ignore-AOSP-First), using the L2CA_Register2 / L2CA_ConnectReq2 APIs. 7/8 lines of the patched region present at android-security-14.0.0_r29.
• Android 15: adapted fix: commit b1e6d8d1e393 in android-security-15.0.0_r6. Same six call sites, but on the L2CA_RegisterWithSecurity / L2CA_ConnectReqWithSecurity APIs (the log::error on registration failure already existed). 7/8 lines of the patched region present at android-security-15.0.0_r17.
• Android 16: not affected per the bulletin (not listed). 5/8 lines of the patched region present at android-security-16.0.0_r8. The material does not show whether the encryption flags are present.
• Android 17: not affected per the bulletin (not listed). 5/8 lines of the patched region present at android-security-17.0.0_r1. The material does not show whether the encryption flags are present.

Unknowns

• The material does not show the concrete attack scenario or what elevated privilege results from an unencrypted AVDTP/AVCTP link. The bulletin only rates it High EoP.
• The material does not show the numeric values of BTA_SEC_ENCRYPT and BTM_SEC_OUT_ENCRYPT or whether they are equivalent.
• The material does not show how BTM enforces the new encryption level, for example whether connections fail or encryption is started on demand.
• The material does not show when AVDT_Register / AVCT_Register are called.
• Whether Android 16/17 code carries the encryption flags (only partial line matches are reported).
• The original change for b/345258562 (d7ff46bc6dc9) is not included. Only the security-branch backports are shown.

Back to March 2025 · Findings