CVE-2023-35657 AI-generated analysis
platform/packages/modules/Bluetooth, BTA AV state machine, system/bta/av/bta_av_aact.cc
In bta_av_setconfig_rej (system/bta/av/bta_av_aact.cc), the peer address placed in the BTA AV reject callback data is now taken from the stream control block (p_scb->PeerAddress()) instead of reading p_data->str_msg.bd_addr from a union that the caller may not have populated as a tBTA_AV_STR_MSG.
Root cause
bta_av_setconfig_rej takes a tBTA_AV_DATA* union and reads p_data->str_msg.bd_addr, assuming the union was set up as a tBTA_AV_STR_MSG. Per the commit message, bta_av_config_ind in bta_av_aact.cc calls bta_av_setconfig_rej in some user journeys with p_data constructed as a tBTA_AV_CI_SETCONFIG, a valid but different union member, and the commit states this causes OOB access. The bulletin classifies the issue as information disclosure (ID).
How the fix works
- system/bta/av/bta_av_aact.cc:bta_av_setconfig_rej: the initializer of the local tBTA_AV bta_av_data.reject.bd_addr is changed from p_data->str_msg.bd_addr to p_scb->PeerAddress(), so the address comes from the stream control block rather than from interpreting p_data as a specific union member; .hndl was already sourced from p_scb->hndl.
- Single one-line commit; no change to callers (bta_av_config_ind) or to the union definition.
Completeness
- The fix removes the only p_data->str_msg access visible in the diff hunk of bta_av_setconfig_rej; the p_data parameter remains in the signature.
- The caller side (bta_av_config_ind passing a tBTA_AV_CI_SETCONFIG) is left as is; the fix relies on the callee no longer trusting the union type rather than on correcting the caller's construction.
- The material does not show the rest of bta_av_setconfig_rej or other bta_av_* handlers, so whether any other handler reads a union member mismatched with how its caller builds p_data cannot be judged from this material.
Behavior changes
- The bd_addr in the reject callback data (bta_av_data.reject) now comes from the stream control block's peer address. For the tBTA_AV_CI_SETCONFIG path it replaces an out-of-bounds read with the stored peer address; for callers that passed a proper tBTA_AV_STR_MSG the material does not show whether the two addresses always match.
- No new error codes, rejections, or timeouts introduced in the diff.
Per major
- Android 14: same fix: commit 09ae4e14509f in android-security-14.0.0_r20 (one-line change, hunk at line 1794); at android-security-14.0.0_r29 the patched region is reported as 2/3 lines present.
- Android 15: same fix: commit 655dbc919736 in android-security-15.0.0_r8, identical one-line diff (hunk at line 1819); at android-security-15.0.0_r17 the patched region is reported as 2/3 lines present.
- Android 16: not listed by the bulletin (not affected per the bulletin); at android-security-16.0.0_r8 the patched region is reported as 2/3 lines present.
- Android 17: not listed by the bulletin (not affected per the bulletin); at android-security-17.0.0_r1 the patched region is reported as 2/3 lines present.
Unknowns
- Which exact branch(es) in bta_av_config_ind pass a tBTA_AV_CI_SETCONFIG to bta_av_setconfig_rej, whether any other caller does the same, and whether the path is remotely reachable.
- Why the per-major check reports 2/3 lines of the patched region rather than 3/3 at the latest tags, and whether the fixed line is among those present.
- Android 13 is listed as affected by the bulletin but no Android 13 commit is included in the material.