CVE-2024-31323 AI-generated analysis
platform/packages/modules/HealthFitness, Health Connect controller UI (apk/)
Adds the HIDE_OVERLAY_WINDOWS permission to the Health Connect controller APK manifest and sets SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS in onCreate of seven Health Connect activities so non-system apps cannot show overlay windows on the Health Connect UI.
Root cause
The Health Connect controller activities (main, data management, migration, onboarding, permission request, settings, exercise route request) created their windows without SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS, and the APK did not request android.permission.HIDE_OVERLAY_WINDOWS. Because of this, windows drawn by non-system apps could stay visible over Health Connect screens, including the permission request and route request UI. The fix comment states this directly: "This flag ensures a non system app cannot show an overlay on Health Connect. b/313425281".
How the fix works
- apk/AndroidManifest.xml: adds <uses-permission android:name="android.permission.HIDE_OVERLAY_WINDOWS" /> with the comment 'Used to disable non system apps from showing overlays'.
- apk/src/com/android/healthconnect/controller/MainActivity.kt:MainActivity.onCreate: calls window.addSystemFlags(WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS) right after super.onCreate and before setContentView.
- apk/src/com/android/healthconnect/controller/data/DataManagementActivity.kt:DataManagementActivity.onCreate: same addSystemFlags call before setContentView.
- apk/src/com/android/healthconnect/controller/migration/MigrationActivity.kt:MigrationActivity.onCreate: same addSystemFlags call before setContentView.
- apk/src/com/android/healthconnect/controller/onboarding/OnboardingActivity.kt:OnboardingActivity.onCreate: same addSystemFlags call before setContentView.
- apk/src/com/android/healthconnect/controller/permissions/request/PermissionsActivity.kt:PermissionsActivity.onCreate: adds window.addSystemFlags(SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS) (statically imported constant) after setContentView, still within onCreate and before the EXTRA_PACKAGE_NAME check.
- apk/src/com/android/healthconnect/controller/permissions/shared/SettingsActivity.kt:SettingsActivity.onCreate: same addSystemFlags call before setContentView.
- apk/src/com/android/healthconnect/controller/route/RouteRequestActivity.kt:RouteRequestActivity.onCreate: same addSystemFlags call after super.onCreate and before the isExerciseRouteEnabled check.
Completeness
- The flag is applied to seven activities in the controller APK: MainActivity, DataManagementActivity, MigrationActivity, OnboardingActivity, PermissionsActivity, SettingsActivity and RouteRequestActivity. All calls are in onCreate, which would normally run before the window is first shown.
- The manifest excerpt only lists MainActivity. The material does not show whether the APK declares other activities or dialog-style windows not covered by this change.
- In PermissionsActivity the call comes after setContentView rather than before, unlike the other six activities. Both are in onCreate, so the ordering difference is probably harmless, but it is an inconsistency in the diff.
- The fix only acts at the window level; the diff does not change any intent validation or permission-granting logic in these activities.
Behavior changes
- While any of the seven Health Connect activities is in the foreground, the window manager hides overlay windows belonging to non-system apps (effect of SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS) (general platform knowledge).
- The controller APK now requests android.permission.HIDE_OVERLAY_WINDOWS.
- The diff does not change Health Connect screen content, error codes or intent handling.
Per major
- Android 14: same fix: commit c4e13d15e8dd in android-security-14.0.0_r9 (cherry-pick of 85c7c82115c8); at android-security-14.0.0_r29 all 8/8 lines of the patched region are present.
- Android 15: not affected per the bulletin; at android-security-15.0.0_r17, 8/8 lines of the patched region are present.
- Android 16: not affected per the bulletin; at android-security-16.0.0_r8, 7/8 lines of the patched region are present (the material does not say which line differs).
- Android 17: not affected per the bulletin; at android-security-17.0.0_r1, 7/8 lines of the patched region are present (the material does not say which line differs).
Unknowns
- Whether the controller APK declares any other activities not touched by this commit (the manifest excerpt only shows MainActivity).
- The specific overlay scenario reported in b/313425281 / b/328561789 beyond what the code comment states.
- Which line of the patched region differs at the Android 16/17 tags (7/8 rather than 8/8).
- Which permission or privilege the framework requires before honouring SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS, and whether the controller APK meets it on a given fork.