mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-12-14 18:34:30 -05:00
c250665b4f
Needs to be in smp_proc_init not smp_proc_rand All other branches checked to be correct 15.1: additionally use @syphyr's response backport due to lack of status field Signed-off-by: Tavi <tavi@divested.dev>
62 lines
2.3 KiB
Diff
62 lines
2.3 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Brian Delwiche <delwiche@google.com>
|
|
Date: Mon, 22 Apr 2024 21:14:56 +0000
|
|
Subject: [PATCH] Fix an authentication bypass bug in SMP
|
|
|
|
When pairing with BLE legacy pairing initiated
|
|
from remote, authentication can be bypassed.
|
|
This change fixes it.
|
|
|
|
Bug: 251514170
|
|
Test: m com.android.btservices
|
|
Test: manual run against PoC
|
|
Ignore-AOSP-First: security
|
|
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:8a3dbadc71428a30b172a74343be08498c656747)
|
|
Merged-In: I66b1f9a80060f48a604001829db8ea7c96c7b7f8
|
|
Change-Id: I66b1f9a80060f48a604001829db8ea7c96c7b7f8
|
|
---
|
|
stack/smp/smp_act.cc | 10 ++++++++++
|
|
stack/smp/smp_int.h | 1 +
|
|
2 files changed, 11 insertions(+)
|
|
|
|
diff --git a/stack/smp/smp_act.cc b/stack/smp/smp_act.cc
|
|
index 7b6ae6f2c..a157b1faf 100644
|
|
--- a/stack/smp/smp_act.cc
|
|
+++ b/stack/smp/smp_act.cc
|
|
@@ -275,6 +275,7 @@ void smp_send_pair_rsp(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
|
|
void smp_send_confirm(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
|
|
SMP_TRACE_DEBUG("%s", __func__);
|
|
smp_send_cmd(SMP_OPCODE_CONFIRM, p_cb);
|
|
+ p_cb->flags |= SMP_PAIR_FLAGS_CMD_CONFIRM_SENT;
|
|
}
|
|
|
|
/*******************************************************************************
|
|
@@ -612,6 +613,15 @@ void smp_proc_init(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
|
|
return;
|
|
}
|
|
|
|
+ if (!((p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT) &&
|
|
+ (p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT)) &&
|
|
+ !(p_cb->flags & SMP_PAIR_FLAGS_CMD_CONFIRM_SENT)) {
|
|
+ // in legacy pairing, the peer should send its rand after
|
|
+ // we send our confirm
|
|
+ smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
|
|
+ return;
|
|
+ }
|
|
+
|
|
/* save the SRand for comparison */
|
|
STREAM_TO_ARRAY(p_cb->rrand, p, BT_OCTET16_LEN);
|
|
}
|
|
diff --git a/stack/smp/smp_int.h b/stack/smp/smp_int.h
|
|
index fc8717f7c..b3e13b3ee 100644
|
|
--- a/stack/smp/smp_int.h
|
|
+++ b/stack/smp/smp_int.h
|
|
@@ -239,6 +239,7 @@ typedef union {
|
|
(1 << 7) /* used to resolve race condition */
|
|
#define SMP_PAIR_FLAG_HAVE_LOCAL_PUBL_KEY \
|
|
(1 << 8) /* used on slave to resolve race condition */
|
|
+#define SMP_PAIR_FLAGS_CMD_CONFIRM_SENT (1 << 9)
|
|
|
|
/* check if authentication requirement need MITM protection */
|
|
#define SMP_NO_MITM_REQUIRED(x) (((x)&SMP_AUTH_YN_BIT) == 0)
|