Skip to content

Commit 82091de

Browse files
AlamIntelsysopenci
AlamIntel
authored and
sysopenci
committed
ASB DEC 2024 Security Patches integration
Integrating Google Android Security Bulletin Patches Test done: STS r33 TCs Passed. Tracked-On: OAM-127575 Signed-off-by: Alam, Sahibex <sahibex.alam@intel.com>
1 parent c802b4d commit 82091de

9 files changed

Lines changed: 433 additions & 1 deletion

‎aosp_diff/preliminary/build/make/04_0004-Update-security_patch_level-string.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ index 47bb92c142..2d0ac256a4 100644
2020
# It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
2121
# If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
2222
- PLATFORM_SECURITY_PATCH := 2022-02-05
23-
+ PLATFORM_SECURITY_PATCH := 2024-11-01
23+
+ PLATFORM_SECURITY_PATCH := 2024-12-01
2424
endif
2525
.KATI_READONLY := PLATFORM_SECURITY_PATCH
2626

‎aosp_diff/preliminary/external/skia/0002-RESTRICT-AUTOMERGE-Check-for-size-overflow-before-allocating-Sk.bulletin.patch‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From e4694498da59d8ec84eaa2c02f7a0252b9b95fb8 Mon Sep 17 00:00:00 2001
2+
From: Brian Osman <brianosman@google.com>
3+
Date: Thu, 29 Aug 2024 12:47:48 -0400
4+
Subject: [PATCH] RESTRICT AUTOMERGE: Check for size overflow before allocating
5+
SkMask data
6+
7+
Bug: 352631932
8+
Test: N/A -- not reproducible / speculative fix
9+
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/894478
10+
Commit-Queue: Ben Wagner <bungeman@google.com>
11+
Reviewed-by: Ben Wagner <bungeman@google.com>
12+
Auto-Submit: Brian Osman <brianosman@google.com>
13+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:1fa94ff39bee75fe3a4abf061c09b972e2ffd0fa)
14+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:cbf6a5953623cdb0ef200bcba00bc43986b16c91)
15+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:bb52abea2589a46c54822b85a309e4b3f1c83ffb)
16+
Merged-In: I74c081a7b849f13194ec7807b7a748d1919c1bb2
17+
Change-Id: I74c081a7b849f13194ec7807b7a748d1919c1bb2
18+
---
19+
src/core/SkBlurMF.cpp | 3 +++
20+
1 file changed, 3 insertions(+)
21+
22+
diff --git a/src/core/SkBlurMF.cpp b/src/core/SkBlurMF.cpp
23+
index 0b8486a587..6e951f7c82 100644
24+
--- a/src/core/SkBlurMF.cpp
25+
+++ b/src/core/SkBlurMF.cpp
26+
@@ -175,6 +175,9 @@ static bool prepare_to_draw_into_mask(const SkRect& bounds, SkMask* mask) {
27+
mask->fRowBytes = SkAlign4(mask->fBounds.width());
28+
mask->fFormat = SkMask::kA8_Format;
29+
const size_t size = mask->computeImageSize();
30+
+ if (size == 0) {
31+
+ return false;
32+
+ }
33+
mask->fImage = SkMask::AllocImage(size, SkMask::kZeroInit_Alloc);
34+
if (nullptr == mask->fImage) {
35+
return false;
36+
--
37+
2.46.1.824.gd892dcdcdd-goog
38+

‎aosp_diff/preliminary/external/skia/0003-Prevent-overflow-when-growing-an-SkRegion-s-RunArray.bulletin.patch‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From 9e7ebd026b3ed8e676e168d9796b2e37e65f1db8 Mon Sep 17 00:00:00 2001
2+
From: Brian Osman <brianosman@google.com>
3+
Date: Thu, 29 Aug 2024 11:52:35 -0400
4+
Subject: [PATCH] Prevent overflow when growing an SkRegion's RunArray
5+
6+
Bug: 350118416
7+
Test: N/A -- speculative issue without repro case
8+
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/894836
9+
Reviewed-by: Robert Phillips <robertphillips@google.com>
10+
Commit-Queue: Brian Osman <brianosman@google.com>
11+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:85802e6d648a7831a26cc856fa5e33da94ed23f0)
12+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c9d1a6c57468cc5e4ab66f7e17d065afd24dee8f)
13+
Merged-In: Iea27fe62ef97deb8a75e8dae276657d809223b57
14+
Change-Id: Iea27fe62ef97deb8a75e8dae276657d809223b57
15+
---
16+
src/core/SkRegion.cpp | 6 ++++--
17+
1 file changed, 4 insertions(+), 2 deletions(-)
18+
19+
diff --git a/src/core/SkRegion.cpp b/src/core/SkRegion.cpp
20+
index 86c38bd5d9..b1ec9f4df8 100644
21+
--- a/src/core/SkRegion.cpp
22+
+++ b/src/core/SkRegion.cpp
23+
@@ -52,8 +52,10 @@ public:
24+
/** Resize the array to a size greater-than-or-equal-to count. */
25+
void resizeToAtLeast(int count) {
26+
if (count > fCount) {
27+
- // leave at least 50% extra space for future growth.
28+
- count += count >> 1;
29+
+ // leave at least 50% extra space for future growth (unless adding would overflow)
30+
+ SkSafeMath safe;
31+
+ int newCount = safe.addInt(count, count >> 1);
32+
+ count = safe ? newCount : SK_MaxS32;
33+
fMalloc.realloc(count);
34+
if (fPtr == fStack) {
35+
memcpy(fMalloc.get(), fStack, fCount * sizeof(SkRegionPriv::RunType));
36+
--
37+
2.46.1.824.gd892dcdcdd-goog
38+

‎aosp_diff/preliminary/external/skia/0004-pdf-Bounds-check-in-skia_alloc_func.bulletin.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
From dab962c2e9788fe6515a637158fb562366c3b373 Mon Sep 17 00:00:00 2001
2+
From: Ben Wagner <bungeman@google.com>
3+
Date: Mon, 12 Aug 2024 15:00:08 -0400
4+
Subject: [PATCH] [pdf] Bounds check in skia_alloc_func
5+
6+
The allocator callback for zlib needs to check that items * size will
7+
fit in size_t and return nullptr if not.
8+
9+
Conflicts:
10+
- src/pdf/SkDeflate.cpp: just in header includes
11+
12+
Bug: 349678452
13+
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/888996
14+
Commit-Queue: Ben Wagner <bungeman@google.com>
15+
Reviewed-by: Brian Osman <brianosman@google.com>
16+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:cc72c2e3d4502aee4d8bc558c2b2bf0dd117b609)
17+
Merged-In: Id1a30592d435bd0de4630e7047f26b0dc17654fc
18+
Change-Id: Id1a30592d435bd0de4630e7047f26b0dc17654fc
19+
---
20+
src/pdf/SkDeflate.cpp | 8 ++++++++
21+
1 file changed, 8 insertions(+)
22+
23+
diff --git a/src/pdf/SkDeflate.cpp b/src/pdf/SkDeflate.cpp
24+
index a8bd667cc0..f243f94b40 100644
25+
--- a/src/pdf/SkDeflate.cpp
26+
+++ b/src/pdf/SkDeflate.cpp
27+
@@ -9,6 +9,7 @@
28+
29+
#include "include/core/SkData.h"
30+
#include "include/private/SkMalloc.h"
31+
+#include "include/private/SkTFitsIn.h"
32+
#include "include/private/SkTo.h"
33+
#include "src/core/SkTraceEvent.h"
34+
35+
@@ -21,6 +22,13 @@ namespace {
36+
// Different zlib implementations use different T.
37+
// We've seen size_t and unsigned.
38+
template <typename T> void* skia_alloc_func(void*, T items, T size) {
39+
+ if (!SkTFitsIn<size_t>(size)) {
40+
+ return nullptr;
41+
+ }
42+
+ const size_t maxItems = SIZE_MAX / size;
43+
+ if (maxItems < items) {
44+
+ return nullptr;
45+
+ }
46+
return sk_calloc_throw(SkToSizeT(items) * SkToSizeT(size));
47+
}
48+
49+
--
50+
2.46.1.824.gd892dcdcdd-goog
51+

‎aosp_diff/preliminary/frameworks/base/99_0293-Properly-handle-onNullBinding-in-appwidget-service-.bulletin.patch‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
From 05f8bee9974ddd9765c3adb68331875283a8c84c Mon Sep 17 00:00:00 2001
2+
From: Pinyao Ting <pinyaoting@google.com>
3+
Date: Thu, 29 Aug 2024 17:01:55 +0000
4+
Subject: [PATCH] Properly handle onNullBinding() in appwidget service.
5+
6+
Bug: 340239088
7+
Test: manually verified with the PoC app
8+
Flag: EXEMPT CVE
9+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:55fa3c2292f04e41a88ded9e319e9f747335bde9)
10+
Merged-In: I12fccb572e159a73785aa33a4f5204e094ccd1b7
11+
Change-Id: I12fccb572e159a73785aa33a4f5204e094ccd1b7
12+
---
13+
core/java/android/widget/RemoteViewsAdapter.java | 5 +++++
14+
.../android/server/appwidget/AppWidgetServiceImpl.java | 10 ++++++++++
15+
2 files changed, 15 insertions(+)
16+
17+
diff --git a/core/java/android/widget/RemoteViewsAdapter.java b/core/java/android/widget/RemoteViewsAdapter.java
18+
index 6b33428d7fe4..275c57e29f00 100644
19+
--- a/core/java/android/widget/RemoteViewsAdapter.java
20+
+++ b/core/java/android/widget/RemoteViewsAdapter.java
21+
@@ -240,6 +240,11 @@ public class RemoteViewsAdapter extends BaseAdapter implements Handler.Callback
22+
}
23+
}
24+
25+
+ @Override
26+
+ public void onNullBinding(ComponentName name) {
27+
+ enqueueDeferredUnbindServiceMessage();
28+
+ }
29+
+
30+
@Override
31+
public void handleMessage(Message msg) {
32+
RemoteViewsAdapter adapter = mAdapter.get();
33+
diff --git a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
34+
index f5063ac4a023..61a86560178a 100644
35+
--- a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
36+
+++ b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
37+
@@ -1776,6 +1776,11 @@ class AppWidgetServiceImpl extends IAppWidgetService.Stub implements WidgetBacku
38+
mContext.unbindService(this);
39+
}
40+
41+
+ @Override
42+
+ public void onNullBinding(ComponentName name) {
43+
+ mContext.unbindService(this);
44+
+ }
45+
+
46+
@Override
47+
public void onServiceDisconnected(ComponentName name) {
48+
// Do nothing
49+
@@ -1916,6 +1921,11 @@ class AppWidgetServiceImpl extends IAppWidgetService.Stub implements WidgetBacku
50+
mContext.unbindService(this);
51+
}
52+
53+
+ @Override
54+
+ public void onNullBinding(ComponentName name) {
55+
+ mContext.unbindService(this);
56+
+ }
57+
+
58+
@Override
59+
public void onServiceDisconnected(android.content.ComponentName name) {
60+
// Do nothing
61+
--
62+
2.46.1.824.gd892dcdcdd-goog
63+

‎aosp_diff/preliminary/system/bt/59_0059-Fix-OOB-write-in-build_read_multi_rsp-of-gatt_sr-cc.bulletin.patch‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
From 84a756e528cc130227cd4ece378fdc488eee2d34 Mon Sep 17 00:00:00 2001
2+
From: Brian Delwiche <delwiche@google.com>
3+
Date: Mon, 8 Jul 2024 22:42:18 +0000
4+
Subject: [PATCH] Fix OOB write in build_read_multi_rsp of gatt_sr.cc
5+
6+
build_read_multi_rsp is missing a bounds check, which can lead to an
7+
OOB write when the mtu parameter is set to zero.
8+
9+
Add that bounds check.
10+
11+
Bug: 323850943
12+
Test: atest GattSrTest
13+
Test: researcher POC
14+
Tag: #security
15+
Flag: EXEMPT trivial validity checks
16+
Ignore-AOSP-First: Security
17+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c177fdbd6189a114239e11e2713740b5a50624e1)
18+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:54f370dbe213031d60d2c3ef24dff7a119274c96)
19+
Merged-In: Icc8209aec68873c9821a36c579cd5df05c6ec8b8
20+
Change-Id: Icc8209aec68873c9821a36c579cd5df05c6ec8b8
21+
---
22+
stack/eatt/eatt.h | 7 ++++++-
23+
stack/gatt/gatt_sr.cc | 7 +++++++
24+
2 files changed, 13 insertions(+), 1 deletion(-)
25+
26+
diff --git a/stack/eatt/eatt.h b/stack/eatt/eatt.h
27+
index 0af2fe3de..31af5cb32 100644
28+
--- a/stack/eatt/eatt.h
29+
+++ b/stack/eatt/eatt.h
30+
@@ -23,6 +23,7 @@
31+
32+
#define EATT_MIN_MTU_MPS (64)
33+
#define EATT_DEFAULT_MTU (256)
34+
+#define EATT_MAX_TX_MTU (1024)
35+
36+
namespace bluetooth {
37+
namespace eatt {
38+
@@ -91,7 +92,11 @@ class EattChannel {
39+
}
40+
state_ = state;
41+
}
42+
- void EattChannelSetTxMTU(uint16_t tx_mtu) { this->tx_mtu_ = tx_mtu; }
43+
+
44+
+ void EattChannelSetTxMTU(uint16_t tx_mtu) {
45+
+ this->tx_mtu_ = std::min<uint16_t>(tx_mtu, EATT_MAX_TX_MTU);
46+
+ this->tx_mtu_ = std::max<uint16_t>(this->tx_mtu_, EATT_MIN_MTU_MPS);
47+
+ }
48+
};
49+
50+
/* Interface class */
51+
diff --git a/stack/gatt/gatt_sr.cc b/stack/gatt/gatt_sr.cc
52+
index 266dc2895..5a3d4bf33 100644
53+
--- a/stack/gatt/gatt_sr.cc
54+
+++ b/stack/gatt/gatt_sr.cc
55+
@@ -142,6 +142,13 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) {
56+
uint8_t* p;
57+
bool is_overflow = false;
58+
59+
+ // We need at least one extra byte for the opcode
60+
+ if (mtu == 0) {
61+
+ LOG(ERROR) << "Invalid MTU";
62+
+ p_cmd->status = GATT_ILLEGAL_PARAMETER;
63+
+ return;
64+
+ }
65+
+
66+
len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;
67+
BT_HDR* p_buf = (BT_HDR*)osi_calloc(len);
68+
p_buf->offset = L2CAP_MIN_OFFSET;
69+
--
70+
2.46.1.824.gd892dcdcdd-goog
71+

‎aosp_diff/preliminary/system/bt/60_0060-Fix-GATT-Read-Multiple-Variable-Response-builder.bulletin.patch‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
From 2063b807d3a4a54deebf214d7b78c1b4fe521322 Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Jakub=20Paw=C5=82owski?= <jpawlowski@google.com>
3+
Date: Thu, 1 Aug 2024 14:12:58 +0000
4+
Subject: [PATCH] Fix "GATT Read Multiple Variable Response" builder
5+
6+
0 length value is perfectly fine, and should result in just length
7+
added into the packet.
8+
Currently, for 0 length value we just break out of loop, and don't add
9+
any value.
10+
This means, that if first characetristic in response had 0 length, we
11+
would return empty packet.
12+
13+
Ignore-AOSP-First: security fix
14+
Test: mma -j32;
15+
Bug: 352696105
16+
Bug: 356886209
17+
Flag: exempt, obvious logic fix
18+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:8bca10d5c1121dd8b9945d3777d69f0a0082a00d)
19+
Merged-In: Ida4f6b566cf9fa40fc5330d8084c29669ccaa608
20+
Change-Id: Ida4f6b566cf9fa40fc5330d8084c29669ccaa608
21+
---
22+
stack/gatt/gatt_sr.cc | 2 +-
23+
1 file changed, 1 insertion(+), 1 deletion(-)
24+
25+
diff --git a/stack/gatt/gatt_sr.cc b/stack/gatt/gatt_sr.cc
26+
index 5a3d4bf33..85b5c9ece 100644
27+
--- a/stack/gatt/gatt_sr.cc
28+
+++ b/stack/gatt/gatt_sr.cc
29+
@@ -192,7 +192,7 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) {
30+
31+
len = std::min((size_t) p_rsp->attr_value.len, mtu - total_len);
32+
33+
- if (len == 0) {
34+
+ if (total_len == mtu && p_rsp->attr_value.len > 0) {
35+
VLOG(1) << "Buffer space not enough for this data item, skipping";
36+
break;
37+
}
38+
--
39+
2.46.1.824.gd892dcdcdd-goog
40+

‎aosp_diff/preliminary/system/bt/61_0061-Encrypt-LE-link-immediately-on-reconnection.bulletin.patch‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
From 302c9a223134835b380333cfdb881960eb4652d3 Mon Sep 17 00:00:00 2001
2+
From: Brian Delwiche <delwiche@google.com>
3+
Date: Wed, 4 Sep 2024 22:01:58 +0000
4+
Subject: [PATCH] Encrypt LE link immediately on reconnection
5+
6+
LE link must be encrypted immediately on connection if device are
7+
already bonded.
8+
9+
This is a backport of ag/29056565, but the code needs to go in a
10+
different location because that patch relies on recent feature work.
11+
12+
Ignore-AOSP-First: security
13+
Test: mmm packages/modules/Bluetooth
14+
Bug: 288144143
15+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:b580e572383f55a572163639864ee66671670325)
16+
Merged-In: Ibb6d651fe53835260ecc6d08215b2a3bd235bced
17+
Change-Id: Ibb6d651fe53835260ecc6d08215b2a3bd235bced
18+
---
19+
stack/acl/btm_acl.cc | 11 +++++++++++
20+
1 file changed, 11 insertions(+)
21+
22+
diff --git a/stack/acl/btm_acl.cc b/stack/acl/btm_acl.cc
23+
index 62a69870a..c74e68388 100644
24+
--- a/stack/acl/btm_acl.cc
25+
+++ b/stack/acl/btm_acl.cc
26+
@@ -1102,6 +1102,17 @@ void StackAclBtmAcl::btm_establish_continue(tACL_CONN* p_acl) {
27+
PRIVATE_ADDRESS(p_acl->RemoteAddress()));
28+
}
29+
btm_set_link_policy(p_acl, btm_cb.acl_cb_.DefaultLinkPolicy());
30+
+ } else if (p_acl->is_transport_ble()) {
31+
+ tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(p_acl->remote_addr);
32+
+
33+
+ if (p_dev_rec == nullptr) {
34+
+ LOG_WARN("No security record for %s",
35+
+ PRIVATE_ADDRESS(p_acl->RemoteAddress()));
36+
+ } else if (p_dev_rec->is_le_link_key_known()) {
37+
+ btm_ble_set_encryption(
38+
+ p_acl->remote_addr, BTM_BLE_SEC_ENCRYPT,
39+
+ p_dev_rec->role_central ? HCI_ROLE_CENTRAL : HCI_ROLE_PERIPHERAL);
40+
+ }
41+
}
42+
NotifyAclLinkUp(*p_acl);
43+
}
44+
--
45+
2.46.1.824.gd892dcdcdd-goog
46+

0 commit comments

Comments
 (0)