fastboot in system/core incorrectly allows privileged commands on a locked device [319546980]

Infeasible

Bug

[AOSP] assigned

Status Update

No update yet.

Description

je...@googlemail.com

created issue #1

Jan 11, 2024 02:26PM

The locking check in the fastboot/device/utility.cpp is

bool GetDeviceLockStatus() {
return android::base::GetProperty("ro.boot.verifiedbootstate", "") == "green";
}

Which means that if you lock the device with your own key (yellow state) fastboot treats it as unlocked. This check should really be

return android::base::GetProperty("ro.boot.verifiedbootstate", "") != "orange";

Which would match the locking check everywhere else in android.

Comments

vi...@google.com <vi...@google.com> #2Jan 11, 2024 04:07PM

Assigned to vi...@google.com.

Thank you for reporting this issue. For us to further investigate this issue, please provide the following additional information:

What steps are needed to reproduce this issue? Frequency of occurrence?

Which Android build are you using? (e.g. TQ3A.230705.001.A1)

Which device did you use to reproduce this issue?

Can you confirm if this issue is reproducible on a Pixel/Nexus device?

Can you provide the API document where this expected behavior is explained?

Please provide a sample project or apk to reproduce the issue. Also mention the steps to be followed for reproducing the issue with the given sample project or apk.

Android bug report (to be captured after reproducing the issue)
For steps to capture a bug report, please refer:

https://developer.android.com/studio/debug/bug-report#bugreportdevice

Alternate method
Navigate to “Developer options”, ensure “USB debugging” is enabled, then enable “Bug report shortcut”. Capture bug report by holding the power button and selecting the “Take bug report” option.

Note: Please upload the bug report and screenshot to google drive and share the folder to android-bugreport@google.com, then share the link here.

je...@googlemail.com <je...@googlemail.com> #3Jan 11, 2024 05:43PM

> What steps are needed to reproduce this issue? Frequency of occurrence?

install your own avb key, resign the OS and reboot

> Which Android build are you using? (e.g. TQ3A.230705.001.A1)

Issue is present in Android-10, 11 and 12

> Which device did you use to reproduce this issue?

Pixel-3

> Can you confirm if this issue is reproducible on a Pixel/Nexus device?

Yes

> Can you provide the API document where this expected behavior is explained?

Not really, the commands are disallowed in the rom based fastboot but not in the one on the recovery partition

vi...@google.com <vi...@google.com> #4Jan 14, 2024 04:53PM

We have shared this with our product and engineering team and will update this issue with more information as it becomes available.

vi...@google.com <vi...@google.com> #5Mar 7, 2024 04:06AM

Thanks for reporting this issue, our product and engineering teams have evaluated the request and responded:

which branch is this observed on? This was probably fixed in one of the android versions, since the check is updated in AOSP. We checked Android T branch as well and it looks like that check is also updated

bool GetDeviceLockStatus() {
    return android::base::GetProperty("ro.boot.verifiedbootstate", "") != "orange";
}

vi...@google.com <vi...@google.com> #6Mar 15, 2024 01:59AM

Please provide the requested information to proceed further. Unfortunately the issue will be closed within 7 days if there is no further update.

vi...@google.com <vi...@google.com> #7Mar 24, 2024 07:03AM

Status: Won't Fix (Infeasible)

We are closing this issue since we didn't receive a response. If you are still facing this problem, please open a new issue and add the relevant information along with reference to this issue.

Issue 319546980