CVE-2023-40073 AI-generated analysis

platform/frameworks/base, core/java/android/app/Notification.java (Notification.visitUris)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

Notification.visitUris() now visits the MessagingStyle extras (EXTRA_MESSAGES, EXTRA_HISTORIC_MESSAGES, EXTRA_CONVERSATION_ICON) and the CallStyle extras (EXTRA_CALL_PERSON, call verification icon) whenever extras is non-null. Before the fix this happened only when isStyle(MessagingStyle.class) or isStyle(CallStyle.class) was true. The already-unconditional EXTRA_MESSAGING_PERSON visit is moved next to the other MessagingStyle extras.

Root cause

In Notification.visitUris(), several URIs were visited only inside `if (isStyle(MessagingStyle.class) && extras != null)` and `if (isStyle(CallStyle.class) & extras != null)` blocks. For MessagingStyle these were the sender icons in EXTRA_MESSAGES and EXTRA_HISTORIC_MESSAGES and EXTRA_CONVERSATION_ICON. For CallStyle they were the EXTRA_CALL_PERSON icon and the verification icon. An app can put these extras into notification.extras without applying the style to the Builder; the test does this with messagingStyle.addExtras(notification.extras) and callStyle.addExtras(notification.extras). In that case isStyle() is false and the visitor never sees those URIs. Per the comment added by the fix, Notification Listeners may still use these extras directly without an isStyle check.

How the fix works

• core/java/android/app/Notification.java:visitUris: the `isStyle(MessagingStyle.class) && extras != null` guard is removed. The EXTRA_MESSAGES, EXTRA_HISTORIC_MESSAGES and EXTRA_CONVERSATION_ICON visits move into the generic `if (extras != null)` block. The EXTRA_MESSAGING_PERSON visit was already in that generic block; it is only moved next to the other MessagingStyle extras, so its behavior is unchanged.
• core/java/android/app/Notification.java:visitUris: the `isStyle(CallStyle.class) & extras != null` guard is removed in the same way. EXTRA_CALL_PERSON (the Person icon URI) and the call verification icon are now visited inside the same `if (extras != null)` block. This also removes the non-short-circuit `&`.
• services/tests/uiservicestests/.../NotificationManagerServiceTest.java: the new test testVisitUris_styleExtrasWithoutStyle builds a notification without a style and injects MessagingStyle and CallStyle extras via addExtras(). It checks that the visitor receives content://user, content://historicalMessenger, content://messenger, content://conversationShortcut, content://caller and content://callVerification.

Completeness

• Covers the MessagingStyle and CallStyle extras that visitUris already handled: they are now visited whether or not a style is applied.
• Other extras in the generic block (EXTRA_LARGE_ICON_BIG, EXTRA_PICTURE_ICON, EXTRA_AUDIO_CONTENTS_URI, EXTRA_BACKGROUND_IMAGE_URI, EXTRA_PEOPLE_LIST, EXTRA_REMOTE_INPUT_HISTORY_ITEMS, EXTRA_MESSAGING_PERSON) were already unconditional and are not changed.
• The fix only widens what visitUris enumerates. It does not change where visitUris is called or how the visited URIs are checked.
• At android-security-14.0.0_r29 the code shows later changes on top of the fix: person.visitUris(visitor), getParcelableArrayFromBundle for EXTRA_MESSAGES, and message.visitUris. These likely account for the 6/8 line match. The unconditional structure and the explanatory comment are present.

Behavior changes

• Content URIs inside MessagingStyle and CallStyle extras are now passed to the visitUris visitor even for notifications that do not declare those styles. Whatever the caller does with visited URIs now also applies to them.
• No new API, error code or configuration. The change is internal to Notification.visitUris.

Per major

• Android 14: same fix: commit 8f326fdea666 in android-security-14.0.0_r3 (linked by bug_id). At android-security-14.0.0_r29, 6/8 lines of the patched region are present, with later refactoring of the visit calls on top.
• Android 15: not affected per the bulletin. At android-security-15.0.0_r17, 6/8 lines of the patched region are present; the code is not otherwise shown.
• Android 16: not affected per the bulletin. At android-security-16.0.0_r8, 6/8 lines of the patched region are present; the code is not otherwise shown.
• Android 17: not affected per the bulletin. At android-security-17.0.0_r1, 6/8 lines of the patched region are present; the code is not otherwise shown.

Unknowns

• The material does not show the commits for Android 11, 12, 12L and 13, which the bulletin lists as affected.
• The material does not show the NotificationManagerService call site that uses visitUris, or what it does with the visited URIs. The impact of the missed URIs is inferred from the fix comment and the test.
• The code at the 15, 16 and 17 tags is not shown beyond the 6/8 line match.
• The material does not show whether visitUris handles any other style-specific extras beyond those in the diff and context.

Back to December 2023 · Findings