Commit d45432ee authored Aug 08, 2023 by Brian Delwiche Committed by Android Build Coastguard Worker Oct 11, 2023

Fix UAF in ~CallbackEnv

com_android_bluetooth_btservice_AdapterService does not null its local
JNI environment variable after detaching the thread (which frees the
environment context), allowing UAF under certain conditions.

Null the variable in this case.

Testing here was done through a custom unit test; see patchsets 4-6 for
contents.  However, unit testing of the JNI layer is problematic in
production, so that part of the patch is omitted for final merge.

Bug: 291500341
Test: atest bluetooth_test_gd_unit, atest net_test_stack_btm
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:7a5c71c32d382c0e14083f0d093ae4f5420968ff)
Merged-In: I3e5e3c51412640aa19f0981caaa809313d6ad030
Change-Id: I3e5e3c51412640aa19f0981caaa809313d6ad030

parent 6cdf985a

android/app/jni/com_android_bluetooth_btservice_AdapterService.cpp

+1 −0

Original line number	Diff line number	Diff line
		@@ -762,6 +762,7 @@ static void callback_thread_event(bt_cb_thread_evt event) {
		}
		vm->DetachCurrentThread();
		sHaveCallbackThread = false;
		callbackEnv = NULL;
		}
		}