CVE-2023-40098 AI-generated analysis

platform/frameworks/base, SystemUI notification guts (NotificationConversationInfo / NotificationGutsManager), People Space widget

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

SystemUI's conversation notification guts now only requests pinning a People Space (priority conversation) widget when the notification's user is in the same profile group as the system user, so marking a conversation as priority on a secondary user no longer triggers the widget pin request.

Root cause

In NotificationConversationInfo.java the "done" click handler, when the selected action is ACTION_FAVORITE and the priority changed, unconditionally called mPeopleSpaceWidgetManager.requestPinAppWidget(mShortcutInfo, new Bundle()). It did not consider which user the StatusBarNotification belonged to, so a conversation from a secondary user could cause a People Space widget pin request for that conversation's shortcut. The bulletin classifies the result as information disclosure; the material does not detail what is exposed.

How the fix works

• NotificationConversationInfo.java: adds a UserManager field (mUm) and a new 'UserManager um' parameter to bindNotification, stored as mUm.
• NotificationConversationInfo.java (done click listener): wraps the requestPinAppWidget call in 'if (mUm.isSameProfileGroup(UserHandle.USER_SYSTEM, mSbn.getNormalizedUserId()))'. The pin request now happens only when the notification's normalized user is in the system user's profile group; mShadeController.animateCollapseShade() and mGutsContainer.closeControls(v, true) still run unconditionally.
• NotificationGutsManager.java: injects UserManager via the constructor (new 'UserManager userManager' parameter, stored in mUserManager) and passes it to notificationInfoView.bindNotification(...) in the conversation-guts binding path.
• Tests: NotificationConversationInfoTest adds a UserManager mock to every bindNotification call, stubs isSameProfileGroup to true in testSelectPriorityRequestsPinPeopleTile, and adds testSelectPriorityRequestsPinPeopleTile_noMultiuser verifying requestPinAppWidget is never called when isSameProfileGroup returns false. NotificationGutsManagerTest passes a UserManager mock to the constructor.

Completeness

• Only the single requestPinAppWidget call site in NotificationConversationInfo's done handler is gated; the fix does not change PeopleSpaceWidgetManager.requestPinAppWidget itself or any other caller of it (none shown in the material).
• The check is relative to UserHandle.USER_SYSTEM, not the current foreground user: profiles of the system user still get the widget prompt, while all other users (and their profiles) are excluded.
• The rest of the done handler is unchanged (shade collapse and closeControls(v, save=true) still run); only the widget pin request is gated.

Behavior changes

• Marking a conversation as priority from a notification belonging to a user outside the system user's profile group no longer shows the People Space widget pin prompt; the shade still collapses and the guts still close.
• Signatures changed: NotificationConversationInfo.bindNotification gains a UserManager parameter and NotificationGutsManager's constructor gains a UserManager parameter.

Per major

• Android 14: same fix: commit 0c5db0349ae6 in android-security-14.0.0_r3 (cherry-pick of adf620316dcf); all 8 lines of the patched region present at android-security-14.0.0_r29.
• Android 15: not affected (not listed by the bulletin); patched region (8/8 lines) present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin); patched region (8/8 lines) present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); patched region (8/8 lines) present at android-security-17.0.0_r1.

Unknowns

• What information the pinned widget exposed and to which user; the material only gives the bulletin type ID and the fix.
• Fix commits for Android 12, 12L and 13 (listed as affected) are not in the material.
• Whether other code paths request pinning People Space widgets for non-system users.
• How the USER_SYSTEM-relative check behaves on headless system user mode devices.
• Where the priority (ACTION_FAVORITE) channel change is persisted; the diff does not show it.
• Where UserManager is provided for Dagger injection into NotificationGutsManager on older branches.

Back to December 2023 · Findings