CVE-2024-31310 AI-generated analysis

platform/frameworks/base, Autofill framework (services/autofill, AutofillManagerServiceImpl)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

AutofillManagerServiceImpl.newServiceInfoLocked now uses PackageManager.queryIntentServicesAsUser to check that the component being set as the autofill service declares the AutofillService.SERVICE_INTERFACE intent filter, and throws SecurityException if it does not.

Root cause

In services/autofill/java/com/android/server/autofill/AutofillManagerServiceImpl.java, newServiceInfoLocked(ComponentName) built an AutofillServiceInfo directly for whatever ComponentName it was given when the autofill service was set or updated. It did not check that the component declares the AutofillService.SERVICE_INTERFACE intent filter, so a service component that was never declared as an autofill service could be accepted.

How the fix works

• AutofillManagerServiceImpl.java:newServiceInfoLocked: before building AutofillServiceInfo, the code calls getContext().getPackageManager().queryIntentServicesAsUser(new Intent(AutofillService.SERVICE_INTERFACE), GET_META_DATA | MATCH_INSTANT, mUserId). This lists the services that declare the autofill intent filter for the user.
• It loops over the ResolveInfo list and compares resolveInfo.serviceInfo.getComponentName() with the requested serviceComponent. On a match it sets serviceHasAutofillIntentFilter.
• If nothing matches, it logs a warning (Slog.w) and throws SecurityException("Service does not declare intent filter " + AutofillService.SERVICE_INTERFACE), so mInfo is never created for a component without the filter.
• MATCH_INSTANT is included on purpose so the CTS test autofill service still resolves when the CTS module runs as an instant app (per the in-code comment and TODO).
• Imports added: android.content.Intent and android.content.pm.ResolveInfo.

Completeness

• The check is added in newServiceInfoLocked. The commit title says it covers setting and updating the service. The material does not show whether other code paths build the service info.
• The check only verifies that the intent filter is declared. This diff adds no permission check (BIND_AUTOFILL_SERVICE) and no exported-ness check. The material does not show whether the AutofillServiceInfo constructor performs such checks.
• This commit does not touch the sibling PerUserSystemService implementations (TranslationManagerServiceImpl, ContentCapturePerUserService, SearchUiPerUserService); see potential_variants.
• The exception is thrown from newServiceInfoLocked. The material does not show how the caller in PerUserSystemService handles a SecurityException (as opposed to NameNotFoundException).

Behavior changes

• Setting or updating the autofill service to a component that does not declare the AutofillService.SERVICE_INTERFACE intent filter now throws SecurityException and logs a warning. Before the fix, such a component was accepted.
• Each run of newServiceInfoLocked now makes an extra PackageManager.queryIntentServicesAsUser call (with GET_META_DATA | MATCH_INSTANT).
• Because of MATCH_INSTANT, instant-app services that declare the filter are matched. The TODO says this flag should be removed once the CTS module is refactored.

Per major

• Android 14: same fix: commit 96bfc01a491b in android-security-14.0.0_r9, a [DO NOT MERGE] cherry-pick of internal changes 141d9d05 / e8a448f8. At android-security-14.0.0_r29, 8/8 lines of the patched region are present.
• Android 15: not affected per the bulletin. The patched region (8/8 lines) is present at android-security-15.0.0_r17.
• Android 16: not affected per the bulletin. The patched region (8/8 lines) is present at android-security-16.0.0_r8.
• Android 17: not affected per the bulletin. The patched region (8/8 lines) is present at android-security-17.0.0_r1.

Unknowns

• Whether the AutofillServiceInfo constructor already did other validation (for example the BIND_AUTOFILL_SERVICE permission) is not shown.
• How the caller of newServiceInfoLocked in PerUserSystemService handles the new SecurityException is not shown.
• The content of the original internal changes 141d9d05 and e8a448f8, and whether they differ from this cherry-pick, is not shown.
• The material does not describe the concrete effect of accepting a non-autofill service as the autofill service, which is the basis for the High EoP rating.
• The Android 12/12L/13 code and how the fix applies there are not shown.

Back to June 2024 · Findings