CVE-2023-40079 AI-generated analysis

platform/frameworks/base, services/core ShortcutService (requestPinAppWidget callback path)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

ShortcutService now sends the client-supplied callback IntentSender with ActivityOptions that set MODE_BACKGROUND_ACTIVITY_START_DENIED, so the PendingIntent no longer benefits from system_server's background-activity-launch privilege.

Root cause

In services/core/java/com/android/server/pm/ShortcutService.java (hunk at ~line 4407), the service calls intentSender.sendIntent(mContext, 0, extras, null, null) on an IntentSender supplied by a client (per the commit message, the callback PendingIntent passed into AppWidgetManager.requestPinAppWidget). Because the send originates from system_server, the PendingIntent could bypass background activity launch (BAL) checks (per the commit message). No ActivityOptions were passed with the send.

How the fix works

• services/core/java/com/android/server/pm/ShortcutService.java: before calling intentSender.sendIntent, build ActivityOptions.makeBasic().setPendingIntentBackgroundActivityStartMode(MODE_BACKGROUND_ACTIVITY_START_DENIED).
• The call is switched to the 7-argument overload intentSender.sendIntent(mContext, 0, extras, null, null, null, options.toBundle()) so the denial option is passed with the send; the existing SendIntentException handling (Slog.w) is unchanged.
• Imports added: static android.app.ActivityOptions.MODE_BACKGROUND_ACTIVITY_START_DENIED and android.app.ActivityOptions.

Completeness

• Only the single sendIntent call in ShortcutService.java shown in the hunk is changed; the fix is a one-file, one-call change.
• The material does not show other places in ShortcutService or in the AppWidget pin flow where a caller-supplied IntentSender/PendingIntent is sent from system_server; whether those exist and are covered is not determinable from the material.
• The commit message lists a manual test, BackgroundActivityLaunchTest, and regression tests (RequestPinAppWidgetTest, PeopleSpaceWidgetManagerTest); no new test is included in the diff.

Behavior changes

• The callback PendingIntent sent by ShortcutService is now sent with a background activity start mode of DENIED, so it can no longer rely on system_server being the sender to start an activity from the background.
• sendIntent now passes a non-null options Bundle (ActivityOptions with background start mode denied) instead of no options.

Per major

• Android 14: same fix: commit 96e0524c48c6 in android-security-14.0.0_r3 (cherry-pick of eb90469587d9, Change-Id I2df9de272192c9a149a9ff519c96e6e0e8304040); at android-security-14.0.0_r29 8/8 lines of the patched region are present.
• Android 15: not affected per the bulletin; the patched code (8/8 lines) is present at android-security-15.0.0_r17.
• Android 16: not affected per the bulletin; patched code present (8/8 lines) at android-security-16.0.0_r8.
• Android 17: not affected per the bulletin; patched code present (8/8 lines) at android-security-17.0.0_r1.

Unknowns

• The name of the enclosing method and the early-return condition preceding the try block are not shown in the hunk.
• Whether other system_server send sites for caller-supplied PendingIntents in the shortcut/appwidget pin flow exist and were addressed separately.
• Effect of the added options on non-activity PendingIntents (broadcast/service) is not shown.
• Which API level introduced the ActivityOptions BAL-mode APIs used by the fix (relevant for trees older than 14) is not shown.
• Why Android 15+ are listed as not affected (the bulletin lists only 14 and 14-next); the material only shows that the patched code is present there.

Back to December 2023 · Findings