CVE-2025-48539 AI-generated analysis
platform/packages/modules/Bluetooth, system/stack/arbiter (ACL arbiter that sends Rust-supplied packets on the L2CAP ATT fixed channel)
In AclArbiter::SendPacketToPeer (system/stack/arbiter/acl_arbiter.cc), the failure-path warning log now reads the length from the rust::Vec argument (buffer.size()) instead of from the BT_HDR p_buf, which L2CA_SendFixedChnlData may already have freed.
Root cause
AclArbiter::SendPacketToPeer allocates a BT_HDR p_buf with osi_malloc, copies the Rust-supplied bytes into it, and passes it to L2CA_SendFixedChnlData(L2CAP_ATT_CID, p_tcb->peer_bda, p_buf). According to the commit message, this intermediate call may free the buffer. When the call does not return L2CAP_DW_SUCCESS, the original code then read p_buf->len inside log::warn, which could read freed memory.
How the fix works
- system/stack/arbiter/acl_arbiter.cc:AclArbiter::SendPacketToPeer: on the L2CA_SendFixedChnlData failure path, the log::warn argument changes from p_buf->len to buffer.size(). buffer is the ::rust::Vec<uint8_t> passed by value into the function and has not been freed at this point. p_buf->len was set from buffer.size() a few lines earlier, so the logged value is the same and p_buf is no longer read after the send call.
- No other code is touched. The allocation, the copy, the offset/len setup and the L2CA_SendFixedChnlData call are unchanged.
Completeness
- In SendPacketToPeer, after L2CA_SendFixedChnlData returns, p_buf is no longer referenced on either branch.
- The fix covers only this call site in acl_arbiter.cc. Other callers of L2CA_SendFixedChnlData are not examined in the material.
- In a TARGET_FLOSS build the function returns early at the top, so that build is unaffected either way.
Behavior changes
- None functionally: the warning logs the same length value (buffer.size() equals the p_buf->len set earlier). Only the source of the value changes.
Per major
- Android 14: not affected per the bulletin. At android-security-14.0.0_r29, 0/5 lines of the patched region are present.
- Android 15: same fix: commit c881220f499e in android-security-15.0.0_r10 (cherry-pick of 243d7484e597), a one-line change from p_buf->len to buffer.size(). At android-security-15.0.0_r17, 4/5 lines of the region are present, in the fixed form.
- Android 16: same fix, adapted to reformatted code: commit 33be5d45cb27 in android-security-16.0.0_r1. It is the same one-line change, in code that uses stack::l2cap::get_interface().L2CA_SendFixedChnlData and tL2CAP_DW_RESULT::SUCCESS. At android-security-16.0.0_r8, 4/5 lines of the region are present.
- Android 17: not affected per the bulletin (not listed). At android-security-17.0.0_r1, 2/5 lines of the patched region are present. The material does not show the content there.
Unknowns
- The material does not show the L2CA_SendFixedChnlData implementation, so the exact conditions under which it frees p_buf are not visible.
- The exact state of acl_arbiter.cc on Android 17 (2/5 lines matching) is not shown.
- Why Android 14 is unaffected (file absent or different code) is not shown beyond the 0/5 line match.