CVE-2024-23712 AI-generated analysis

platform/frameworks/base, AppOps (services/core AppOpsService) and package parsing (ParsedAttributionImpl)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (9 corrections). Verify against the commit before relying on it.

AppOpsService now validates the proxy attribution tag on the note and start operation paths (nulling tags not declared in the proxy or target package), and ParsedAttributionImpl.MAX_NUM_ATTRIBUTIONS is reduced from 10000 to 1000.

Root cause

In AppOpsService the proxied attributionTag was already validated through verifyAndGetBypass (pvr.isAttributionTagValid nulls it when invalid, visible in the r29 context). The proxyAttributionTag supplied on the note and start operation paths was used without any check that it is declared by the proxy package or the target package. Separately, the per-package attribution limit ParsedAttributionImpl.MAX_NUM_ATTRIBUTIONS was 10000. The bulletin classifies the issue as a High severity DoS; the exact exhaustion mechanism is not shown in the material.

How the fix works

• services/core/java/com/android/server/appop/AppOpsService.java: adds private helper isAttributionTagDefined(packageName, proxyPackageName, attributionTag). It returns false if packageName is null and true if attributionTag is null. Otherwise it gets PackageManagerInternal. If proxyPackageName is non-null and its AndroidPackage is found, it returns true when isAttributionInPackage(proxyPkg, attributionTag). Otherwise it returns isAttributionInPackage(pmInt.getPackage(packageName), attributionTag).
• AppOpsService.java, note path (hunk after an early MODE_ERRORED SyncNotedAppOp return and before synchronized(this)/getOpsLocked, likely noteOperationUnchecked): if proxyAttributionTag != null and !isAttributionTagDefined(packageName, proxyPackageName, proxyAttributionTag), proxyAttributionTag is set to null.
• AppOpsService.java, start path (hunk after an early MODE_ERRORED return and before 'boolean isRestricted = false; int startType = START_TYPE_FAILED;'): the same nulling of an undefined proxyAttributionTag.
• services/core/java/com/android/server/pm/pkg/component/ParsedAttributionImpl.java: MAX_NUM_ATTRIBUTIONS lowered from 10000 to 1000.

Completeness

• Covers proxyAttributionTag on the note and start paths only; the proxied attributionTag was already handled by existing verifyAndGetBypass/isAttributionTagValid logic (r29 context).
• Validation is lenient: an undefined proxy tag is replaced with null and the operation continues; no error is returned.
• isAttributionTagDefined accepts the tag if it is declared in either the proxy package or the target package, so a tag declared only in the target package is still accepted as a proxy tag.
• The helper may call isAttributionInPackage with a null package when the target package is not found; the material does not show how that case is handled.
• The attribution cap is reduced, not removed.

Behavior changes

• Proxy attribution tags not declared in the proxy or target package are dropped (set to null) on the proxy note/start flows; no new error code is returned.
• The per-package attribution limit constant drops from 10000 to 1000; where it is enforced is not shown in the material.
• Each note/start with a non-null proxyAttributionTag now performs PackageManagerInternal.getPackage lookups.

Per major

• Android 14: Same fix: commit 6beb68ca17d1 (RESTRICT AUTOMERGE cherry-pick of 2806d263c0b7) in android-security-14.0.0_r7; 8/8 lines of the patched region present at android-security-14.0.0_r29.
• Android 15: Not affected per the bulletin (not listed); patched region present (8/8 lines) at android-security-15.0.0_r17.
• Android 16: Not affected per the bulletin (not listed); patched region present (8/8 lines) at android-security-16.0.0_r8.
• Android 17: Not affected per the bulletin (not listed); patched region present (8/8 lines) at android-security-17.0.0_r1.

Unknowns

• The exact DoS mechanism (what is exhausted) is not shown in the material.
• Whether isAttributionInPackage tolerates a null AndroidPackage.
• The enclosing method names of both hunks are not shown directly.
• How MAX_NUM_ATTRIBUTIONS is enforced during parsing.
• Whether other AppOps entry points (e.g. finish paths or async noting) consume a proxy attribution tag without this validation.

Back to April 2024 · Findings