CVE-2023-40096 AI-generated analysis

platform/frameworks/av, services/audiopolicy (AudioPolicyService, OpRecordAudioMonitor / AppOps record-audio monitoring)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

AudioPolicyService::OpRecordAudioMonitor now registers its AppOps watcher with AppOpsManager::WATCH_FOREGROUND_CHANGES only for apps that target SDK U or later, after an interim revert that removed the flag for all apps. For those apps, foreground and background transitions are watched, so background recording can be silenced.

Root cause

In services/audiopolicy/service/AudioPolicyService.cpp, OpRecordAudioMonitor::onFirstRef() calls checkOp() and then mAppOpsManager.startWatchingMode(mAppOp, packageName, mOpCallback). Without the AppOpsManager::WATCH_FOREGROUND_CHANGES flag, the watcher is not registered for foreground-state changes. A foreground-only record op is therefore not re-evaluated when the app goes to the background. An earlier commit, 7370c8442e66 ("Listen for foreground AppOps changes"), had passed the flag unconditionally. The two commits in the material first revert it, because it broke VOIP apps that record in the background, and then re-apply it based on the app's targetSdk.

How the fix works

• Commit 3f5420f7eb60 (android-security-14.0.0_r2), AudioPolicyService.cpp:OpRecordAudioMonitor::onFirstRef: reverts 7370c8442e66 by removing the AppOpsManager::WATCH_FOREGROUND_CHANGES argument from mAppOpsManager.startWatchingMode(). Stated reason: top VOIP apps rely on recording in the background without capabilities.
• Commit dc0af854d4dd (android-security-14.0.0_r3), AudioPolicyService.cpp: adds two helpers in an anonymous namespace. getTargetSdkForPackageName() looks up 'package_native' via defaultServiceManager()->checkService, casts it to content::pm::IPackageManagerNative and calls getTargetSdkVersionForPackage(); it returns -1 on any failure. doesPackageTargetAtLeastU() returns targetSdk >= __ANDROID_API_U__. The commit also adds #include <android/content/pm/IPackageManagerNative.h>.
• Same commit, OpRecordAudioMonitor::onFirstRef: computes int flags = doesPackageTargetAtLeastU(mAttributionSource.packageName.value_or("")) ? AppOpsManager::WATCH_FOREGROUND_CHANGES : 0 and passes flags to startWatchingMode(). Apps targeting U or later get the foreground-change watcher. Apps targeting older SDKs keep the prior behavior, per the commit message.
• At android-security-14.0.0_r29, the IPackageManagerNative.h include is at line 28 of AudioPolicyService.cpp. This is consistent with the second commit being on the release branch.

Completeness

• The change touches only the flags passed to startWatchingMode() in OpRecordAudioMonitor::onFirstRef(). Neither diff touches checkOp() or RecordAudioOpCallback.
• The restriction applies only to packages whose targetSdk is U or later. Packages targeting an older SDK are not watched for foreground changes and keep the pre-fix behavior by design.
• getTargetSdkForPackageName() fails open. If 'package_native' is unavailable, the interface cast fails, or getTargetSdkVersionForPackage() returns an error, targetSdk is -1 and the WATCH_FOREGROUND_CHANGES flag is not set.
• These commits do not address the existing TODO in onFirstRef ('We need to always watch AppOpsManager::OP_RECORD_AUDIO too since it controls the mic permission for legacy apps').
• The material does not include the original commit 7370c8442e66 or any fix applied to Android 11, 12, 12L and 13, which the bulletin lists as affected.

Behavior changes

• For apps with targetSdk U or later, the record-audio AppOp watcher is registered with WATCH_FOREGROUND_CHANGES, so per the commit message their recording can be silenced in the background. Apps targeting older SDKs keep the previous behavior.
• onFirstRef() of OpRecordAudioMonitor now makes a binder call to the package_native service (getTargetSdkVersionForPackage) each time a monitor is created.
• Between the two commits (android-security-14.0.0_r2 only), the foreground watcher was removed for all apps.

Per major

• Android 14: Fixed by two commits in frameworks/av: the revert 3f5420f7eb60 in android-security-14.0.0_r2 (removes WATCH_FOREGROUND_CHANGES), then dc0af854d4dd in android-security-14.0.0_r3 (re-adds it when targetSdk is U or later). At android-security-14.0.0_r29, the IPackageManagerNative.h include from the second commit is present. The resolver reports 1/4 lines of the patched region present, which may reflect the later rewrite of that call (inference).
• Android 15: Not affected (not listed by the bulletin). The resolver reports 1/4 lines of the patched region present at android-security-15.0.0_r17.
• Android 16: Not affected (not listed by the bulletin). The resolver reports 1/4 lines of the patched region present at android-security-16.0.0_r8.
• Android 17: Not affected (not listed by the bulletin). The resolver reports 1/4 lines of the patched region present at android-security-17.0.0_r1.

Unknowns

• The material does not include the original commit 7370c8442e66 ('Listen for foreground AppOps changes') or show what else it changed.
• The material does not show how RecordAudioOpCallback and checkOp() react to the callback, which is where the silencing happens.
• The material does not show the fixes applied to Android 11, 12, 12L and 13, which the bulletin lists as affected.
• The material does not show what getTargetSdkVersionForPackage returns for an empty package name (the value_or("") case).
• The material shows the state of OpRecordAudioMonitor::onFirstRef on the 15/16/17 security tags only as resolver line counts.

Back to December 2023 · Findings