CVE-2023-40125 AI-generated analysis

platform/packages/apps/Settings, network/apn (ApnEditor fragment)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

Adds a user-restriction gate to ApnEditor.onCreate in Settings so the APN editor finishes immediately when the current user is not an admin or carries the DISALLOW_CONFIG_MOBILE_NETWORKS restriction.

Root cause

ApnEditor (src/com/android/settings/network/apn/ApnEditor.java) did not consult UserManager in onCreate, so neither the admin-user status nor the DISALLOW_CONFIG_MOBILE_NETWORKS user restriction was enforced before the APN editing UI and the rest of fragment initialization ran. A non-admin or restricted user could therefore reach APN configuration that the restriction is meant to block.

How the fix works

• ApnEditor.java:onCreate: right after super.onCreate(icicle), calls the new isUserRestricted(); if true, logs an error, calls finish() and returns before setLifecycleForAllControllers() and the rest of the fragment initialization runs.
• ApnEditor.java:isUserRestricted (new, @VisibleForTesting): obtains UserManager via getContext().getSystemService(UserManager.class); returns false if it is null; returns true if !userManager.isAdminUser(); returns true if userManager.hasUserRestriction(UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS); otherwise false.
• ApnEditorTest.java: adds a mocked UserManager (admin user, no restriction by default) to setUp, plus onCreate_notAdminUser_shouldFinish and onCreate_hasUserRestriction_shouldFinish verifying finish() is called.

Completeness

• The gate is applied only at onCreate of ApnEditor; the diff adds no independent check to the fragment's later entry points (menu actions, save/delete paths, dialogs), which rely on onCreate having finished the fragment.
• The check is fail-open when UserManager cannot be obtained (userManager == null returns false, so the editor proceeds).
• Only the ApnEditor fragment is changed; the material does not show whether the APN list screen or other APN-related entry points in Settings perform equivalent checks.
• The check runs after super.onCreate, so base fragment creation completes before finish() is invoked; this is a UI-level finish, not a throw.

Behavior changes

• ApnEditor now closes immediately (finish()) for non-admin users and for users with DISALLOW_CONFIG_MOBILE_NETWORKS, logging 'This setting isn't available due to user restriction.' plus a reason line at error level.
• Non-admin users lose access to the APN editor UI entirely, even without an explicit DISALLOW_CONFIG_MOBILE_NETWORKS restriction.

Per major

• Android 14: same fix: commit 97b5b908aeb8 in android-security-14.0.0_r1 and an identical commit b4e4facff447 (same Change-Id Iecdbbff7e21dfb11e3ba385858747a220cfd3e04) in android-security-14.0.0_r2; at android-security-14.0.0_r29 all 8/8 lines of the patched region are present.
• Android 15: not affected per the bulletin; patched region fully present (8/8 lines) at android-security-15.0.0_r17.
• Android 16: not affected per the bulletin; patched region fully present (8/8 lines) at android-security-16.0.0_r8.
• Android 17: not affected per the bulletin; patched region fully present (8/8 lines) at android-security-17.0.0_r1.

Unknowns

• The material does not show the fix commits for Android 11, 12, 12L and 13, which the bulletin lists as affected.
• The material does not show how ApnEditor is reached (which intents or parent screens launch it) nor whether those callers already enforce the same restriction.
• The material does not show how the patched code came to be present in the 15, 16 and 17 tags.
• The bulletin does not describe the concrete impact beyond rating it High EoP.

Back to October 2023 · Findings