CVE-2024-0043 AI-generated analysis
platform/packages/modules/Permission, PermissionController role-controller (CompanionDevice*RoleBehavior)
The fix changes the four Companion Device profile role behaviors (App Streaming, Computer, Glasses, Watch) in PermissionController's role-controller so they skip granting and revoking notification access when the role controller is running in a managed (work) profile.
Root cause
CompanionDeviceAppStreamingRoleBehavior, CompanionDeviceComputerRoleBehavior, CompanionDeviceGlassesRoleBehavior and CompanionDeviceWatchRoleBehavior implemented RoleBehavior.grant() by always calling NotificationUtils.grantNotificationAccessForPackage(context, packageName), and revoke() by always calling NotificationUtils.revokeNotificationAccessForPackage(context, packageName). Neither checked which profile the role controller was running in. As a result, a package given one of these companion device profile roles in a managed (work) profile also got notification access there. The commit message states the intent: "Do not grant notification access for work apps." The bulletin rates this as a High severity EoP.
How the fix works
- CompanionDeviceAppStreamingRoleBehavior.java:grant and :revoke: obtain UserHandle user = Process.myUserHandle() and wrap the NotificationUtils.grantNotificationAccessForPackage / revokeNotificationAccessForPackage call in if (!UserUtils.isManagedProfile(user, context)). Imports for android.os.Process, android.os.UserHandle and com.android.role.controller.util.UserUtils are added.
- CompanionDeviceComputerRoleBehavior.java:grant and :revoke: identical change.
- CompanionDeviceGlassesRoleBehavior.java:grant and :revoke: identical change.
- CompanionDeviceWatchRoleBehavior.java:grant and :revoke: identical change.
- The check uses the user of the role controller process itself (Process.myUserHandle()), not a user passed in as a parameter. A role controller running in a managed profile therefore no longer changes notification access at all. UserUtils.isManagedProfile is an existing helper: the diff only adds its import, and its body is not shown.
Completeness
- Covers all four companion device profile role behaviors in this diff that call NotificationUtils: App Streaming, Computer, Glasses and Watch. Both grant() and revoke() are gated.
- revoke() is also skipped in a managed profile. Going by the code, notification access granted in a work profile before the fix would not be revoked by these behaviors when the role is later revoked. The commit contains no migration or one-time revocation logic.
- The gate depends only on managed-profile status. The material does not show how NotificationUtils or UserUtils behave, or whether other role behaviors grant notification access, so coverage beyond these four files cannot be judged.
Behavior changes
- In a managed (work) profile, granting a Companion Device App Streaming, Computer, Glasses or Watch role to a package no longer grants it notification access.
- In a managed profile, revoking those roles no longer revokes notification access either.
- No change for users that are not managed profiles. No new error is raised: the calls are simply skipped.
Per major
- Android 14: Same fix: commit 70d22f185f27 in android-security-14.0.0_r5 (cherry-picked from commit fd6c9ab8f4a5, Change-Id Ie6078a1081bf9f98466bfbf2bc0b54a7af7b4951). At android-security-14.0.0_r29, 8/8 lines of the patched region are present.
- Android 15: Not affected (not listed by the bulletin). At android-security-15.0.0_r17, CompanionDeviceAppStreamingRoleBehavior.java, CompanionDeviceComputerRoleBehavior.java and CompanionDeviceGlassesRoleBehavior.java are absent at the patched paths. The Watch file is not reported absent.
- Android 16: Not affected (not listed by the bulletin). At android-security-16.0.0_r8 the same three files are absent at the patched paths. The Watch file is not reported absent.
- Android 17: Not affected (not listed by the bulletin). At android-security-17.0.0_r1 the same three files are absent at the patched paths. The Watch file is not reported absent.
Unknowns
- The implementations of UserUtils.isManagedProfile and NotificationUtils.grantNotificationAccessForPackage are not in the material, so the exact type of notification access granted is not shown.
- How the role grant is reached from an unprivileged context (the EoP path) is not shown.
- Why Android 15 and later are considered not affected is not shown. The material only shows that three of the four files are absent at the original paths.
- Whether CompanionDeviceWatchRoleBehavior.java in 15/16/17 still exists at that path and contains the managed-profile check.