CVE-2024-0035 AI-generated analysis
platform/frameworks/base, SystemUI Quick Settings external tiles (packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java)
SystemUI's TileLifecycleManager now overrides ServiceConnection.onNullBinding and calls executeSetBindService(false) so that a TileService returning a null binding is unbound instead of staying bound.
Root cause
TileLifecycleManager.bindServices() binds an app-supplied TileService via Context.bindServiceAsUser with BIND_AUTO_CREATE | BIND_FOREGROUND_SERVICE_WHILE_AWAKE | BIND_WAIVE_PRIORITY, plus BIND_ALLOW_BACKGROUND_ACTIVITY_STARTS when the START_ACTIVITY_NEEDS_PENDING_INTENT compat change is not enabled for the package. Before the fix, the class implemented onServiceConnected and onServiceDisconnected but not onNullBinding. When a null binding was reported, nothing unbound the connection, so SystemUI kept the app's service bound even though no tile wrapper was created.
How the fix works
- packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java: adds an @Override of onNullBinding(ComponentName name) that calls executeSetBindService(false), the same method the tests use to drive binding, so the connection created in bindServices() is released when a null binding is reported.
- packages/SystemUI/tests/src/com/android/systemui/qs/external/TileLifecycleManagerTest.java: adds testNullBindingCallsUnbind, which binds with a mock Context whose bindServiceAsUser returns true, captures the ServiceConnection, invokes onNullBinding on it, runs the executor, and verifies unbindService(captor.getValue()) is called.
Completeness
- The fix covers only the onNullBinding callback; the diff adds no other ServiceConnection handling (onBindingDied handling is not shown in the material).
- The bind flags in bindServices() are unchanged; the fix does not reduce what a successfully bound TileService receives, it only ensures a null-binding service does not stay bound.
- The test runs mExecutor.runAllReady() after onNullBinding before verifying unbindService; the exact threading of executeSetBindService(false) is not shown.
- The fix does not touch mBindTryCount; retry behavior after a null binding is not shown in the material.
Behavior changes
- A TileService for which a null binding is reported is now unbound by SystemUI instead of remaining bound.
- No new error codes or user-visible messages; the change is only in connection lifecycle handling.
Per major
- Android 14: same fix: commit 7b7fff1eb501 in android-security-14.0.0_r5 (cherry-pick of 7cf363d1fe7c, Change-Id Ia8126ac65432b124683960e3ebf47301ba6172a1); at android-security-14.0.0_r29 all 7/7 lines of the patched region are present.
- Android 15: not listed by the bulletin as affected; at android-security-15.0.0_r17, 6/7 lines of the patched region are present.
- Android 16: not listed by the bulletin as affected; at android-security-16.0.0_r8, 6/7 lines of the patched region are present.
- Android 17: not listed by the bulletin as affected; at android-security-17.0.0_r1, 6/7 lines of the patched region are present.
Unknowns
- The body of executeSetBindService(false) and the exact unbind/cleanup it performs are not shown (only the test's verification that unbindService is called).
- Whether TileLifecycleManager overrides onBindingDied, and how a null binding interacts with the bind retry logic (mBindTryCount), is not shown.
- Which line differs in the 6/7 match on Android 15/16/17, and why the bulletin does not list those versions despite most of the patched region being present, is not shown.
- Code state on Android 11, 12, 12L and 13 (listed as affected) is not in the material.