CVE-2024-31331 AI-generated analysis
platform/frameworks/base, PackageManagerService (package manager, MIME group / intent filter handling)
PackageManagerService.setMimeGroup now sends an ACTION_PACKAGE_CHANGED broadcast for the package, once per user where it is installed and with dontKillApp=true. It does this whenever mComponentResolver.updateMimeGroup reports a change, in addition to clearing the package's preferred activities.
Root cause
In services/core/java/com/android/server/pm/PackageManagerService.java, setMimeGroup() commits the new MIME type set via commitPackageStateMutation() and then calls mComponentResolver.updateMimeGroup(). Before the fix, when that call returned true, the method only cleared the package's preferred activities (mPreferredActivityHelper.clearPackagePreferredActivities). It sent no ACTION_PACKAGE_CHANGED broadcast for the mimeGroup change.
How the fix works
- PackageManagerService.java:setMimeGroup: the Binder.withCleanCallingIdentity lambda that ran clearPackagePreferredActivities(packageName, UserHandle.USER_ALL) is extended. After clearing preferred activities, it takes a fresh Computer via snapshotComputer() and builds a components list that holds only the package name. It reads appId from the packageState obtained before the mutation and resolves all user ids with resolveUserIds(UserHandle.USER_ALL).
- For each user id, it looks up packageState.getUserStates().get(userId). If that state exists and isInstalled(), it computes packageUid = UserHandle.getUid(userId, appId) and calls sendPackageChangedBroadcast(snapShot, packageName, true /* dontKillApp */, components, packageUid, "The mimeGroup is changed").
- The broadcast is sent only inside the existing `if (mComponentResolver.updateMimeGroup(...))` branch. The early return for identical MIME type sets and the 255-character and 500-entry limits are unchanged.
Completeness
- Covers only the setMimeGroup path, which is the single place in the diff where mimeGroups are changed. The broadcast is gated on updateMimeGroup() returning true, the same gate as the existing clearPackagePreferredActivities call, so a change to the stored MIME types that the resolver does not report sends no broadcast.
- For appId and per-user install state, the broadcast loop uses the packageState snapshot taken before commitPackageStateMutation. Users where the package is not installed get no broadcast.
- The broadcast uses dontKillApp=true. The material does not show whether any other code path that changes a package's intent filters also lacks this broadcast.
Behavior changes
- When a mimeGroup change makes updateMimeGroup return true, ACTION_PACKAGE_CHANGED is now sent for the package to every user where it is installed. The call passes a components list holding the package name, dontKillApp=true and the reason "The mimeGroup is changed".
- The broadcast is sent under a cleared calling identity, in the same block as clearPackagePreferredActivities. No new error codes or exceptions are introduced.
Per major
- Android 14: Same fix: commit 352a84fa6c0f in android-security-14.0.0_r10 (linked by bug_id). At android-security-14.0.0_r29 all 6/6 patched lines are present in setMimeGroup.
- Android 15: Not affected per the bulletin. At android-security-15.0.0_r17 the patched region is present 6/6.
- Android 16: Not affected per the bulletin. At android-security-16.0.0_r8 the patched region is present 6/6.
- Android 17: Not affected per the bulletin. At android-security-17.0.0_r1 the patched region is present 6/6.
Unknowns
- The material does not show which consumer of ACTION_PACKAGE_CHANGED was affected by the missing broadcast, or how that leads to the bulletin's EoP rating.
- Fix commits for Android 12, 12L and 13 (listed as affected) are not provided, so whether the change had to be adapted for those branches is unknown.
- Whether the CTS tests named in the commit message were updated in a separate change is not shown.
- How sendPackageChangedBroadcast turns the components list into intent extras is not shown.