CVE-2023-45777 AI-generated analysis

platform/frameworks/base, services/core AccountManagerService (validation of authenticator KEY_INTENT results)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (11 corrections). Verify against the commit before relying on it.

In AccountManagerService.checkKeyIntentParceledCorrectly, replaces the deprecated untyped Bundle.getParcelable(KEY_INTENT) read of the authenticator-supplied bundle with the typed getParcelable(KEY_INTENT, Intent.class).

Root cause

checkKeyIntentParceledCorrectly(Bundle bundle) writes the result bundle to a Parcel and reads it back. Its comment says this makes sure the Authenticator cannot trick users into launching arbitrary intents through Parcel read/write mismatches. Before the fix it read KEY_INTENT from the original bundle with the deprecated untyped bundle.getParcelable(AccountManager.KEY_INTENT), and enforced the type only afterwards with an intent.getClass() != Intent.class check. The exact flaw this allowed is not shown in the material.

How the fix works

• services/core/java/com/android/server/accounts/AccountManagerService.java: checkKeyIntentParceledCorrectly: `Intent intent = bundle.getParcelable(AccountManager.KEY_INTENT);` becomes `bundle.getParcelable(AccountManager.KEY_INTENT, Intent.class)`, which requests an Intent-typed read.
• Commit e6a018a83696 changes only this one line (1 insertion, 1 deletion). The existing `intent != null && intent.getClass() != Intent.class` check right after it is unchanged.

Completeness

• The r3 commit changes only the read from the original `bundle`. The diff does not show the read from `simulateBundle`.
• At android-security-14.0.0_r29 the method reads both `bundle` and `simulateBundle` with getParcelable(..., Intent.class), has an explicit `if (intent == null) return (simulateIntent == null);` branch, and checks both objects' classes, followed by filterEquals, selector and prohibited-flag checks. These lines are not part of this commit, and the material does not say which commits added them.

Behavior changes

• The KEY_INTENT value from the authenticator bundle is now read through the typed, Intent-class getParcelable API. The material does not show the resulting control flow when that value is not an Intent.

Per major

• Android 14: same fix: commit e6a018a83696 in android-security-14.0.0_r3. At android-security-14.0.0_r29 the method contains the typed read of `bundle` (and of `simulateBundle`); 2/4 lines of the original patched region are present.
• Android 15: not affected (not listed by the bulletin); 2/4 lines of the patched region present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin); 2/4 lines of the patched region present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); 2/4 lines of the patched region present at android-security-17.0.0_r1.

Unknowns

• The material does not show the object type or Parcel layout that bypassed the untyped read, or the rest of the r3-era method body below the diff (for example, how a null `intent` was handled).
• The commits that later changed the simulateBundle read and added the null branch are not in the material.
• Why only 2/4 lines of the patched region match in the latest tags.
• Where checkKeyIntentParceledCorrectly is called from.
• The bulletin lists Android 13 as affected, but the material gives no Android 13 per-major fact.

Back to December 2023 · Findings