CVE-2023-40092 AI-generated analysis

platform/frameworks/base, services/core ShortcutService (ShortcutManager system service)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Adds a check in ShortcutService.verifyShortcutInfoPackage that the user ID embedded in a caller-supplied ShortcutInfo equals the user ID of the Binder calling UID, throwing SecurityException otherwise.

Root cause

verifyShortcutInfoPackage(String callerPackage, ShortcutInfo si) only verified that si.getPackage() equals the caller's package name. The caller-supplied ShortcutInfo also carries a user ID (si.getUserId()), which was never compared against the calling UID's user. verifyCaller() checks the userId argument of the API call against the caller, but the per-shortcut user ID inside each ShortcutInfo was unchecked, so shortcut objects tagged with another user's ID were not rejected by this function.

How the fix works

• services/core/java/com/android/server/pm/ShortcutService.java:verifyShortcutInfoPackage: after the existing package-name mismatch check, obtains callingUid via injectBinderCallingUid() and throws SecurityException("User-ID in shortcut doesn't match the caller") if UserHandle.getUserId(callingUid) != si.getUserId().
• Because verifyShortcutInfoPackages(String, List<ShortcutInfo>) loops over every element and calls verifyShortcutInfoPackage, the new check applies to every shortcut in a list passed through it.

Completeness

• Covers every path that goes through verifyShortcutInfoPackage / verifyShortcutInfoPackages; null ShortcutInfo entries still return early without checks (sanitizeShortcutSizes removes null entries, but its call order relative to the verification is not shown).
• verifyShortcutInfoPackage has no isCallerSystem() early return (unlike verifyCaller()), so the new user-ID check runs for any caller that reaches it; the material does not show whether system paths reach it or pass shortcuts for a different user.
• Only the user ID is validated; no other ShortcutInfo fields gain validation in this change. Paths that handle ShortcutInfo without calling verifyShortcutInfoPackage(s), if any, are not visible in the material.

Behavior changes

• Calls whose ShortcutInfo passes through verifyShortcutInfoPackage(s) with a user ID different from the caller's user now fail with SecurityException("User-ID in shortcut doesn't match the caller") instead of being accepted.
• verifyShortcutInfoPackage has no system-caller bypass, so if a system caller reaches it, the check applies to that caller as well.

Per major

• Android 14: same fix: commit af8827252ba2 in android-security-14.0.0_r3 (cherry-pick, Change-Id Idbde676f871db83825155730e3714f3727e25762); 3/3 patched lines present at android-security-14.0.0_r29.
• Android 15: not affected per bulletin; the 3 patched lines are present at android-security-15.0.0_r17.
• Android 16: not affected per bulletin; the 3 patched lines are present at android-security-16.0.0_r8.
• Android 17: not affected per bulletin; the 3 patched lines are present at android-security-17.0.0_r1.

Unknowns

• Which IShortcutService entry points call verifyShortcutInfoPackage(s) and whether every ShortcutInfo-accepting path goes through them.
• Whether sanitizeShortcutSizes runs after verifyShortcutInfoPackages on the publish paths.
• What concrete information was disclosed by a cross-user shortcut (the bulletin only rates it High / ID).
• Whether any legitimate system caller relied on publishing shortcuts with a different user ID and is affected by the lack of a system exemption.

Back to December 2023 · Findings