CVE-2025-48593 AI-generated analysis
platform/packages/modules/Bluetooth, system/bta/hf_client (HFP hands-free client, SDP discovery)
bta_hf_client_cb_init now cancels any outstanding SDP service search and frees the HF client's discovery database (p_disc_db) before the control block is zeroed, instead of silently dropping the pointer.
Root cause
In system/bta/hf_client/bta_hf_client_main.cc, bta_hf_client_cb_init released the collision timer and the hf_indicators containers and then reset the whole control block with `*client_cb = {}`, without handling client_cb->p_disc_db. If a discovery database was allocated and an SDP search was outstanding, the reset discarded the pointer without cancelling the search or freeing the database. A comment in the Android 16 code (bta_hf_client_do_disc) says a preexisting discovery database can lead to a race and a UAF once the connection is closed. The Android 14 commit message says the earlier flag-guarded changes for b/291281168 only partly resolved the issue and that a check was needed at this additional location.
How the fix works
- system/bta/hf_client/bta_hf_client_main.cc:bta_hf_client_cb_init: before `*client_cb = {}`, if client_cb->p_disc_db is non-null, call SDP_CancelServiceSearch(client_cb->p_disc_db) (logging APPL_TRACE_WARNING with the peer address if cancellation fails) and then osi_free_and_reset((void**)&client_cb->p_disc_db).
- system/bta/test/bta_dip_test.cc (which includes stack/sdp/sdp_api.cc): adds stubs for sdpu_find_ccb_by_db and sdp_disconnect.
- system/bta/test/bta_hf_client_add_record_test.cc: adds a stub SDP_CancelServiceSearch that returns false.
- Android 16 counterpart (5ed63461b441): removes the aconfig flag btsec_check_valid_discovery_database. This makes three checks unconditional: the p_disc_db check in bta_hf_client_cb_init, the preexisting-database check in bta_hf_client_sdp.cc:bta_hf_client_do_disc, and the NULL p_db check in sdp_discovery.cc:process_service_search_attr_rsp.
Completeness
- Covers every reinitialisation of an HF client control block through bta_hf_client_cb_init, including bta_hf_client_cb_arr_init per index search.
- On Android 14 and 15 the commit changes only bta_hf_client_cb_init. The two other checks visible in the Android 16 commit (bta_hf_client_do_disc and process_service_search_attr_rsp, flag bug 356201480) are not in the 14/15 diffs. The material does not show whether they exist on those branches, or whether they are the b/291281168 changes the commit message refers to.
- If SDP_CancelServiceSearch returns false, the code only logs a warning and still frees p_disc_db. The material does not show what state the SDP layer is left in on that path.
- Other code paths that may free or replace p_disc_db outside bta_hf_client_cb_init are not shown and are not changed by this commit.
Behavior changes
- Reinitialising an HF client control block now cancels a pending SDP service search on its discovery database and frees that database. A warning is logged if cancellation fails.
- Android 16 only: behaviours that were behind btsec_check_valid_discovery_database are now always on. bta_hf_client_do_disc logs an error and resets p_disc_db when a discovery database already exists. process_service_search_attr_rsp logs a warning when there is no discovery database.
Per major
- Android 14: same fix: commit 75ecc79c24e0 in android-security-14.0.0_r23 adds the p_disc_db cancel-and-free block to bta_hf_client_cb_init (direct SDP_CancelServiceSearch, APPL_TRACE_WARNING), plus test stubs. 8/8 lines present at r29.
- Android 15: adapted fix: commit c69c78d7c4f6 in android-security-15.0.0_r11. Same logic, but it calls get_legacy_stack_sdp_api()->service.SDP_CancelServiceSearch and uses log::warn. 5/5 lines present at r17.
- Android 16: adapted fix: the check already existed behind the aconfig flag btsec_check_valid_discovery_database. Commit 5ed63461b441 in android-security-16.0.0_r2 (resolver matched by change_id) makes the checks in bta_hf_client_cb_init, bta_hf_client_do_disc and process_service_search_attr_rsp unconditional, and deletes the flag from flags/security.aconfig. 5/8 lines of the patched region present at r8.
- Android 17: not affected (not listed by the bulletin); patched region present (8/8) at android-security-17.0.0_r1.
Unknowns
- The exact sequence by which a control block with a live p_disc_db reaches bta_hf_client_cb_init (callers other than bta_hf_client_cb_arr_init are not shown).
- Whether the flag-guarded checks in bta_hf_client_do_disc and process_service_search_attr_rsp exist on the Android 14 and 15 security branches, and whether they are the b/291281168 changes.
- What SDP_CancelServiceSearch does, including on failure, and whether the SDP layer could still reference the freed database.
- Why the Android 16 patched-region match is 5/8 at android-security-16.0.0_r8.