CVE-2023-40075 AI-generated analysis

platform/frameworks/base, ShortcutService (services/core/java/com/android/server/pm/ShortcutPackage.java)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Moves the ensureShortcutCountBeforePush() call in ShortcutPackage from the push path (the method whose disabled-shortcut message references pushDynamicShortcuts()) into forceReplaceShortcutInner, right before saveShortcut(), to bound shortcuts published through addDynamicShortcuts.

Root cause

Before the fix, ShortcutPackage.java called ensureShortcutCountBeforePush() only in the push path (right after the Preconditions check whose message references pushDynamicShortcuts()). forceReplaceShortcutInner saved shortcuts without it. Per the commit message, when an app has multiple main activities, the total number of shortcuts published through addDynamicShortcuts could grow indefinitely. The bulletin classifies this as a DoS.

How the fix works

• ShortcutPackage.java:forceReplaceShortcutInner: after forceDeleteShortcutInner(newShortcut.getId()), saveIconAndFixUpShortcutLocked and fixUpShortcutResourceNamesAndValues, a call to ensureShortcutCountBeforePush() is inserted immediately before saveShortcut(newShortcut).
• ShortcutPackage.java: the ensureShortcutCountBeforePush() call that followed Preconditions.checkArgument(newShortcut.isEnabled(), "pushDynamicShortcuts() cannot publish disabled shortcuts") is removed. Net diff: 1 insertion, 1 deletion, one file.

Completeness

• Any code that saves a shortcut through forceReplaceShortcutInner now runs ensureShortcutCountBeforePush() first. Which methods call forceReplaceShortcutInner is not shown.
• The material does not show whether the push path still reaches ensureShortcutCountBeforePush() after its own call was removed.
• Paths that call saveShortcut() directly, without forceReplaceShortcutInner, are not covered by this change. The material does not show whether such paths exist.
• The implementation of ensureShortcutCountBeforePush() (the limit it applies, and whether it rejects or evicts) is not in the material.

Behavior changes

• Shortcuts saved through forceReplaceShortcutInner are now subject to ensureShortcutCountBeforePush() before saveShortcut(). The commit message names addDynamicShortcuts as the affected API.
• The count check no longer runs at the start of the push path. Its effect on that path depends on call structure not shown in the material.

Per major

• Android 14: same fix: resolved via commit 052789e6a57d in android-security-14.0.0_r3 (linked by bug_id); at android-security-14.0.0_r29 all 8/8 lines of the patched region are present.
• Android 15: not affected (not listed by the bulletin); at android-security-15.0.0_r17 the patched region is present (8/8 lines).
• Android 16: not affected (not listed by the bulletin); at android-security-16.0.0_r8 the patched region is present (8/8 lines).
• Android 17: not affected (not listed by the bulletin); at android-security-17.0.0_r1 the patched region is present (8/8 lines).

Unknowns

• The body of ensureShortcutCountBeforePush() and the limit it enforces are not shown.
• Whether addOrReplaceDynamicShortcut and the push path call forceReplaceShortcutInner. The full list of callers of forceReplaceShortcutInner/saveShortcut is not shown.
• The name of the method the check was removed from is not shown in the diff.
• The bulletin lists Android 11, 12, 12L, 13 as affected, but only the Android 14 commit is in the material.

Back to December 2023 · Findings