CVE-2025-26423 AI-generated analysis

platform/packages/modules/Wifi, Wifi service (WifiConfigurationUtil, IP configuration validation of WifiConfiguration)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

Adds size and validity checks for the static IP configuration (DNS server count, domains length) and HTTP proxy info (isValid, host length, exclusion list count and total length) in WifiConfigurationUtil.validateIpConfiguration, so that oversized IP configuration data supplied with a WifiConfiguration is rejected during validation.

Root cause

Before the fix, WifiConfigurationUtil.validateIpConfiguration (as far as the diff context shows) checked the static IP configuration for a null static address. It did not bound the number of DNS servers in StaticIpConfiguration or the length of the domains string. It also did not check anything about the IpConfiguration's ProxyInfo: its validity, host length, number of exclusion list entries, or total exclusion list length. A WifiConfiguration passed to validate() (for example via the VALIDATE_FOR_ADD path the tests use) could therefore carry arbitrarily large IP configuration fields and still pass validation. The material does not show the downstream consequence. The bulletin rates the issue High EoP.

How the fix works

• service/java/com/android/server/wifi/WifiConfigurationUtil.java: adds the constant MAX_ENTRY_SIZE = 100 next to the existing MAX_STRING_LENGTH = 512, and imports android.net.ProxyInfo.
• WifiConfigurationUtil.validateIpConfiguration, inside the block that handles staticIpConfig, after the null static-address check: rejects the config if staticIpConfig.getDnsServers() is non-null and has more than MAX_ENTRY_SIZE (100) entries, or if staticIpConfig.getDomains() is non-null and longer than MAX_STRING_LENGTH (512). Each failure logs an error and returns false.
• WifiConfigurationUtil.validateIpConfiguration, after the static block closes (so it is not limited to static configs): fetches ipConfig.getHttpProxy(). If that is non-null, it returns false when proxyInfo.isValid() is false, when getHost() is longer than 512, when getExclusionList() has more than 100 entries, or when the running sum of exclusion list string lengths exceeds 512.
• service/tests/wifitests/src/com/android/server/wifi/WifiConfigurationUtilTest.java: adds testInvalidStaticIpConfig (a 513-char domains string in a static config with a PAC proxy) and testInvalidProxyInfo (a direct proxy with a 513-char exclusion entry). Both assert that WifiConfigurationUtil.validate(..., VALIDATE_FOR_ADD) returns false.

Completeness

• Covers: DNS server count and domains length for the static IP configuration; proxy validity, host length, exclusion list entry count and cumulative entry length for any IpConfiguration that carries an HTTP proxy.
• The DNS server and domains checks sit only inside the static-config block. The code shown does not indicate whether these StaticIpConfiguration fields can be populated otherwise.
• No explicit length check is added for a PAC proxy URL (ProxyInfo.getPacFileUrl). Only proxyInfo.isValid() covers that case, and the material does not show what isValid enforces.
• Per-entry exclusion list length is bounded only through the cumulative sum (512 total).
• The checks only take effect on code paths that call WifiConfigurationUtil.validate / validateIpConfiguration. The material shows only the VALIDATE_FOR_ADD path from the tests, so coverage of other entry points (update, restore/deserialization) is not demonstrated.

Behavior changes

• WifiConfiguration validation now fails (validate returns false and logs a Log.e 'validateIpConfiguration failed: ...' message) for static IP configs with more than 100 DNS servers or a domains string over 512 characters.
• Validation now fails for any IpConfiguration whose ProxyInfo is not valid per ProxyInfo.isValid(), has a host over 512 characters, has more than 100 exclusion list entries, or whose exclusion list entries total more than 512 characters.
• Configurations with unusually large proxy exclusion lists or domain search strings, which were previously accepted, are now rejected.

Per major

• Android 14: same fix: commit a51669fbf6f6 in android-security-14.0.0_r20 (cherry-pick, Change-Id I761dbb38ffa2e4dcebad2a6abb8d37d45a3b1fd8). The patched region is fully present (8/8 lines) at android-security-14.0.0_r29.
• Android 15: same fix: commit 01e708a7a9af in android-security-15.0.0_r8. The hunks are identical apart from a line offset in validateIpConfiguration (@@ -721 vs -694). The patched region is fully present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin); the patched region (8/8 lines) is present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); the patched region (8/8 lines) is present at android-security-17.0.0_r1.

Unknowns

• The concrete downstream effect of an oversized IP configuration (which component fails, or how it leads to EoP) is not shown in the material.
• Which public Wifi API entry points reach WifiConfigurationUtil.validateIpConfiguration, and whether all of them (add, update, restore) pass through it.
• What ProxyInfo.isValid() enforces, and therefore whether PAC URL length is bounded.
• The full pre-fix body of validateIpConfiguration and the condition guarding the static-config block.
• The bulletin lists Android 13 as affected, but the material includes no Android 13 commit.

Back to May 2025 · Findings