CVE-2024-31332 AI-generated analysis

platform/packages/apps/Settings, Wi-Fi (Wi-Fi DPP configurator and Add Network UI)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Settings now checks the DISALLOW_ADD_WIFI_CONFIG user restriction in WifiDppConfiguratorActivity (onCreate and handleIntent) and AddNetworkFragment (onCreate), and finishes the activity when the restriction is set, so a restricted user can no longer use these UI entry points to add Wi-Fi configurations.

Root cause

WifiDppConfiguratorActivity and AddNetworkFragment in Settings let users reach Wi-Fi network configuration flows (DPP/QR provisioning and the manual add-network form) without checking UserManager.hasUserRestriction(DISALLOW_ADD_WIFI_CONFIG). WifiDppConfiguratorActivity.handleIntent only rejected guest users (isGuestUser). As a result, a user with the admin-set DISALLOW_ADD_WIFI_CONFIG restriction could still reach these flows. The bulletin rates this as High severity EoP.

How the fix works

• src/com/android/settings/wifi/AddNetworkFragment.java:onCreate - after super.onCreate, calls the new static helper isAddWifiConfigAllowed(getContext()). If it returns false, it calls getActivity().finish() and returns.
• src/com/android/settings/wifi/AddNetworkFragment.java:isAddWifiConfigAllowed - new @VisibleForTesting static helper. It gets UserManager from the context and returns false (with Log.e) when userManager != null and hasUserRestriction(DISALLOW_ADD_WIFI_CONFIG) is true. Otherwise it returns true.
• src/com/android/settings/wifi/dpp/WifiDppConfiguratorActivity.java:onCreate - after super.onCreate, calls isAddWifiConfigAllowed(getApplicationContext()). If it returns false, it calls finish() and returns before the savedInstanceState restore block.
• src/com/android/settings/wifi/dpp/WifiDppConfiguratorActivity.java:handleIntent - same check at the top, before the existing isGuestUser check. If it returns false, it calls finish() and returns, so the check applies whenever handleIntent is invoked.
• src/com/android/settings/wifi/dpp/WifiDppConfiguratorActivity.java:isAddWifiConfigAllowed - new static helper, identical to the one in AddNetworkFragment.
• tests/unit/.../AddNetworkFragmentTest.java and tests/unit/.../WifiDppConfiguratorActivityTest.java - new unit tests for isAddWifiConfigAllowed with and without the restriction (mocked UserManager).

Completeness

• Covers WifiDppConfiguratorActivity at onCreate and handleIntent, and AddNetworkFragment at onCreate only.
• The check is fail-open when UserManager is null (userManager != null && ...): a missing UserManager service counts as 'allowed'.
• AddNetworkFragment finishes its host activity from inside the fragment. The check runs once, at fragment creation, and is not repeated if the restriction changes while the UI is open.
• WifiDppConfiguratorActivity looks up UserManager through getApplicationContext(), while AddNetworkFragment uses getContext().
• The commit touches only these two classes. The material does not show whether other Settings entry points that create Wi-Fi configurations enforce the restriction.

Behavior changes

• When DISALLOW_ADD_WIFI_CONFIG is set for the user, WifiDppConfiguratorActivity finishes on creation and whenever handleIntent is invoked, and AddNetworkFragment finishes its host activity on creation. Each path logs the error 'The user is not allowed to add Wi-Fi configuration.'
• The finish paths added by this fix set no result code (unlike the existing AddNetworkFragment cancel path, which sets RESULT_CANCELED).
• No behavior change for users without the restriction.

Per major

• Android 13: Listed as affected by the bulletin. The material includes no Android 13 commit, so how the fix was applied there is unknown.
• Android 14: Same fix: commit 20b312f86a70 ([RESTRICT AUTOMERGE] cherry-pick, Change-Id I34afe0f698e2dc43eba59b25f5f3f4f61e70166a) in android-security-14.0.0_r10. The patched region is fully present (8/8 lines) at android-security-14.0.0_r29.
• Android 15: Not affected (not listed by the bulletin). The patched region is present (8/8 lines) at android-security-15.0.0_r17.
• Android 16: Not affected (not listed by the bulletin). The patched region is present (8/8 lines) at android-security-16.0.0_r8.
• Android 17: Not affected (not listed by the bulletin). The patched region is present (8/8 lines) at android-security-17.0.0_r1.

Unknowns

• The Android 13 fix commit and how the fix was applied there.
• Whether other Settings Wi-Fi configuration entry points outside these two classes already enforce DISALLOW_ADD_WIFI_CONFIG.
• Which code paths call WifiDppConfiguratorActivity.handleIntent (for example from WifiDppBaseActivity or onNewIntent).
• The exact launch path (exported component, intent actions) used in the original report. Bug id 299931076 is referenced but not described.

Back to July 2024 · Findings