CVE-2023-40111 AI-generated analysis

platform/frameworks/base, media session service (services/core/java/com/android/server/media/MediaSessionRecord.java) and MediaSession client API (media/java/android/media/session/MediaSession.java)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

The media session service's setMediaButtonReceiver now logs and ignores PendingIntents that target an activity, so a media button receiver can no longer be used to bypass background activity launch restrictions.

Root cause

In MediaSessionRecord, the session binder stub's setMediaButtonReceiver stored any caller-supplied PendingIntent into mMediaButtonReceiverHolder (via MediaButtonReceiverHolder.create) after checking only the SESSION_POLICY_IGNORE_BUTTON_RECEIVER policy. Nothing checked what kind of PendingIntent it was, so an app could register one that targets an activity. The commit message says this allowed a bypass of background activity launch restrictions.

How the fix works

• services/core/java/com/android/server/media/MediaSessionRecord.java, setMediaButtonReceiver (session binder stub): after the existing SESSION_POLICY_IGNORE_BUTTON_RECEIVER check and before MediaButtonReceiverHolder.create, a new test `if (pi != null && pi.isActivity())` logs a warning ("Ignoring invalid media button receiver targeting an activity") and returns. It does not update mMediaButtonReceiverHolder or call mService.onMediaButtonReceiverChanged.
• media/java/android/media/session/MediaSession.java, setMediaButtonReceiver: the javadoc now says the PendingIntent must not target an activity and that such calls are ignored. It now recommends PendingIntent#getService. The RemoteException handler changes from Log.wtf to e.rethrowFromSystemServer().

Completeness

• The check runs in system_server for every caller of ISession.setMediaButtonReceiver, whatever the target SDK. There is no CompatChanges gate, unlike the THROW_FOR_INVALID_BROADCAST_RECEIVER gate in setMediaButtonBroadcastReceiver.
• Only pi.isActivity() is rejected. Other PendingIntent kinds are still accepted without further validation.
• The sibling API setMediaButtonBroadcastReceiver takes a ComponentName and already checks package ownership and that the component exists. This change does not touch it.
• setSessionActivity / setLaunchPendingIntent is documented to take an activity intent for UI and is unchanged.
• Per the commit message, on Android U the enforcement only ignores the call and logs a warning. The behavior of the original change (ag/23810567) is not shown in the material.

Behavior changes

• Calling MediaSession.setMediaButtonReceiver with an activity PendingIntent is now silently ignored by the service, with a Log.w in system_server. Any previously stored receiver is kept, and the app gets no exception.
• A RemoteException in the client-side MediaSession.setMediaButtonReceiver is now rethrown via rethrowFromSystemServer instead of being swallowed with Log.wtf.
• The setMediaButtonReceiver documentation now recommends PendingIntent#getService instead of getActivity.

Per major

• Android 14: Same fix: commit 55d3d57cbffc in android-security-14.0.0_r2 (cherry-pick, a backport of ag/23810567). The code at android-security-14.0.0_r29 shows the isActivity() check present in MediaSessionRecord's setMediaButtonReceiver. The per-major check reports 3 of 8 lines of the patched region matching.
• Android 15: Not affected per the bulletin. 3 of 8 lines of the patched region match at android-security-15.0.0_r17. The Android 15 code itself is not shown.
• Android 16: Not affected per the bulletin. 3 of 8 lines of the patched region match at android-security-16.0.0_r8. The code is not shown.
• Android 17: Not affected per the bulletin. 3 of 8 lines of the patched region match at android-security-17.0.0_r1. The code is not shown.

Unknowns

• The material does not show the media button dispatch path that sends through mMediaButtonReceiverHolder, so it does not show how or under which identity the activity launch happened.
• The material does not show what the original change ag/23810567 does on later releases (the commit says U only ignores and logs), or why only 3 of 8 lines of the patched region match on 14 to 17.
• The material does not show whether a MediaButtonReceiverHolder can be filled from sources other than setMediaButtonReceiver.

Back to November 2023 · Findings