CVE-2024-34721 AI-generated analysis
platform/packages/providers/MediaProvider, MediaProvider insert path generation (cross-user storage volume check)
Adds an assertFileColumnsConsistent(match, uri, values) call in MediaProvider.java right after FileUtils.computeDataFromValues(). This covers the case where DATA is generated from values such as RELATIVE_PATH and DISPLAY_NAME, so files can no longer be inserted into another user's storage volume.
Root cause
In MediaProvider.java, the block commented 'Generate path when undefined' runs when ContentValues has no DATA. There, FileUtils.computeDataFromValues() computes DATA from the resolved volume path plus caller-supplied values such as RELATIVE_PATH and DISPLAY_NAME. Per the commit message, inserting into other users' storage volumes was already blocked when DATA was set explicitly, but not when DATA was generated this way. A generated path could therefore land in another user's storage volume. The same file would then exist in both users' MediaProvider databases, and MediaProvider would falsely assume that the user has access to the file.
How the fix works
- src/com/android/providers/media/MediaProvider.java, in the block commented '// Generate path when undefined' (enclosing function name not shown in the material): after FileUtils.sanitizeValues(values, ...) and FileUtils.computeDataFromValues(values, volumePath, isFuseThread()), the fix adds assertFileColumnsConsistent(match, uri, values). The generated values are therefore checked before the result File is built and before the primary-directory checks.
- tests/src/com/android/providers/media/MediaProviderTest.java:testInsertionWithInvalidFilePath_throwsIllegalArgumentException: the test input changes. Before: a '../'-traversal DISPLAY_NAME under RELATIVE_PATH 'Android/media/com.example'. After: RELATIVE_PATH 'Android/media/com.example/' with DISPLAY_NAME 'data/media/test.txt'. The test still expects an IllegalArgumentException with the 'Primary directory Android not allowed' message.
Completeness
- Covers the code path where DATA is absent from the values and is generated from the volume path plus caller values. Per the commit message, the explicit-DATA path was already handled (that code is not shown in the material).
- The check runs before FileUtils.buildUniqueFile / buildNonUniqueFile, so the final filename those helpers produce is not checked again. The material does not show whether those helpers can change the directory component.
- Only one call site is modified. The material does not show other places that call FileUtils.computeDataFromValues() or otherwise derive DATA without the assertion.
Behavior changes
- Inserts whose generated values fail assertFileColumnsConsistent() now throw instead of creating the file. This may also apply to renames of existing files that reach this block (the code handles a currentPath there). The exception type and message are not shown in the material.
- The input of the existing test testInsertionWithInvalidFilePath_throwsIllegalArgumentException was changed; it still expects the primary-directory IllegalArgumentException.
Per major
- Android 14: Same fix: commit 520edca27f2d (a cherry-pick) landed in android-security-14.0.0_r10 (linked by bug_id). At android-security-14.0.0_r29 the assertFileColumnsConsistent call is present right after computeDataFromValues (7/8 lines of the patched region present).
- Android 15: Not affected (not listed by the bulletin); at android-security-15.0.0_r17, 7/8 lines of the patched region are present.
- Android 16: Not affected (not listed by the bulletin); at android-security-16.0.0_r8, 7/8 lines of the patched region are present.
- Android 17: Not affected (not listed by the bulletin); at android-security-17.0.0_r1, 4/8 lines of the patched region are present.
Unknowns
- How assertFileColumnsConsistent is implemented (what it compares, which exception it throws) is not shown.
- The name of the function that contains the patched block is not shown.
- The existing check for explicitly set DATA, mentioned in the commit message, is not shown, nor whether it uses the same helper.
- Why the test input was changed is not stated in the material.