From 8cb8616068246454cb7b12300aacd0bb997f2edc Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Tue, 19 May 2026 05:01:51 +0100 Subject: [PATCH] fix(spoof): bound future patch dates in updateTo PatchLevelManager only rejected dates more than ~1 year in the past. A MITM serving 2099-12-31 from a spoofed bulletin response slipped through validation and got written to security_patch.txt plus resetprop'd. Add a 60-day upper bound past today using LocalDate.plusDays so month boundaries are handled correctly. The existing past bound stays. --- .../TEESimulator/config/PatchLevelManager.kt | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/config/PatchLevelManager.kt b/app/src/main/java/org/matrix/TEESimulator/config/PatchLevelManager.kt index 6a7a215..d9c8d40 100644 --- a/app/src/main/java/org/matrix/TEESimulator/config/PatchLevelManager.kt +++ b/app/src/main/java/org/matrix/TEESimulator/config/PatchLevelManager.kt @@ -15,6 +15,7 @@ object PatchLevelManager { private const val STAGING_FILE = "/data/adb/tricky_store/security_patch.txt.next" private const val FLOOR_YYYYMMDD = 20200101 private const val MAX_PAST_OFFSET = 10000 + private const val MAX_FUTURE_DAYS = 60L private val DATE_PATTERN = Regex("^\\d{4}-\\d{2}-\\d{2}$") private val PROP_PATTERN = Regex("^SECURITY_PATCH=(.+)$", RegexOption.MULTILINE) @@ -50,14 +51,24 @@ object PatchLevelManager { SystemLogger.warning("PatchLevelManager: $date below floor $FLOOR_YYYYMMDD") return } - val today = - LocalDate.now().let { it.year * 10000 + it.monthValue * 100 + it.dayOfMonth } + val now = LocalDate.now() + val today = now.year * 10000 + now.monthValue * 100 + now.dayOfMonth if (today >= dateInt + MAX_PAST_OFFSET) { SystemLogger.warning( "PatchLevelManager: $date more than 1y older than today ($today)" ) return } + val maxFuture = + now.plusDays(MAX_FUTURE_DAYS).let { + it.year * 10000 + it.monthValue * 100 + it.dayOfMonth + } + if (dateInt > maxFuture) { + SystemLogger.warning( + "PatchLevelManager: $date more than $MAX_FUTURE_DAYS days in future ($maxFuture)" + ) + return + } atomicWrite(date) AndroidDeviceUtils.setProperty("ro.build.version.security_patch", date) AndroidDeviceUtils.setProperty("ro.vendor.build.security_patch", date)