CVE-2023-40095 AI-generated analysis

platform/frameworks/base, system_server PendingIntent sending options (services/core PendingIntentUtils; the commit title names the requestGeofence path)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

The fix makes PendingIntentUtils.createDontSendToRestrictedAppsBundle explicitly call setPendingIntentBackgroundActivityLaunchAllowed(false) on the BroadcastOptions it builds. PendingIntents that system_server sends with these options (the commit title names requestGeofence) can no longer be used to bypass background activity launch restrictions.

Root cause

createDontSendToRestrictedAppsBundle in services/core/java/com/android/server/PendingIntentUtils.java built BroadcastOptions that only called setDontSendToRestrictedApps(true). It did not call setPendingIntentBackgroundActivityLaunchAllowed(false). According to the commit title, this allowed a bypass of background activity launch restrictions via requestGeofence.

How the fix works

• services/core/java/com/android/server/PendingIntentUtils.java:createDontSendToRestrictedAppsBundle: one line is added, options.setPendingIntentBackgroundActivityLaunchAllowed(false), before the options are converted to a Bundle. The option therefore applies both in the bundle == null branch and in the branch that merges into an existing bundle via bundle.putAll(options.toBundle()).
• Every caller of this helper gets the option, so every send that uses this bundle now explicitly denies background activity launch.

Completeness

• Covers every send path that gets its options from createDontSendToRestrictedAppsBundle, including the case where an existing Bundle is merged.
• Does not cover system_server code that sends app-supplied PendingIntents without this helper; the material does not show such sites. Per index search, ConnectivityService.sendIntent (packages/modules/Connectivity) sets setPendingIntentBackgroundActivityLaunchAllowed(false) on its own when isAtLeastT() is true, without using this helper.
• The existing setDontSendToRestrictedApps(true) behavior is unchanged.

Behavior changes

• PendingIntents sent with this bundle no longer get background activity launch allowed through the sender options.
• No API change; the change is limited to the options Bundle this helper builds.

Per major

• Android 14: same fix: commit d1421cacf6bb in android-security-14.0.0_r3 (cherry-picked from 7f9be7c3c859, Change-Id Ia8094244f908b20d42711b6ea8f58f9b3345b563); at android-security-14.0.0_r29 all 5/5 lines of the patched region are present.
• Android 15: not affected per the bulletin; the patched region is present at android-security-15.0.0_r17 (5/5 lines).
• Android 16: not affected per the bulletin; the patched region is present at android-security-16.0.0_r8 (5/5 lines).
• Android 17: not affected per the bulletin; the patched region is present at android-security-17.0.0_r1 (5/5 lines).

Unknowns

• The material shows no call sites of createDontSendToRestrictedAppsBundle beyond the commit title's reference to requestGeofence, so the full set of affected system services is not visible.
• The exact trigger conditions (app state, how the launch is obtained) are not shown.
• How the fix was applied to Android 11, 12, 12L and 13 (listed as affected) is not in the material, nor whether setPendingIntentBackgroundActivityLaunchAllowed exists on those branches.
• The commit only records 'Test: manually'; it includes no regression test.

Back to December 2023 · Findings