CVE-2024-34734 AI-generated analysis
platform/frameworks/base, SystemUI Quick Settings footer actions (FooterActionsViewModel)
SystemUI's Quick Settings footer now routes the "active apps" (foreground services) button click through ActivityStarter.dismissKeyguardThenExecute, so the foreground services dialog opens only after the keyguard is dismissed instead of opening directly while the screen is locked.
Root cause
In packages/SystemUI/src/com/android/systemui/qs/footer/ui/viewmodel/FooterActionsViewModel.kt, the click handler for the foreground services ("active apps") footer button called footerActionsInteractor.showForegroundServicesDialog(expandable) directly; the only thing before it in the hunk is an early return. Nothing checked the lock state. Per the commit message, this meant the active apps dialog could be shown while the screen was locked, which made a VPN app killable from the lockscreen.
How the fix works
- FooterActionsViewModel.kt: the class constructor and its inner Factory gain a new ActivityStarter dependency (private val activityStarter: ActivityStarter). Factory.create() passes it to the view model.
- FooterActionsViewModel.kt, foreground services click handler: the direct call to footerActionsInteractor.showForegroundServicesDialog(expandable) is replaced by activityStarter.dismissKeyguardThenExecute({ footerActionsInteractor.showForegroundServicesDialog(expandable); false }, null /* cancelAction */, true /* afterKeyguardGone */). Per the commit message, if the screen is locked the user is prompted to unlock, and the dialog opens only after a successful unlock. No cancel action is set.
- packages/SystemUI/tests/utils/src/com/android/systemui/qs/footer/FooterActionsTestUtils.kt: adds a shared mockActivityStarter, passes it to the FooterActionsViewModel constructor, and makes footerActionsInteractor() use the same mock as its default activityStarter.
Completeness
- Only the foreground services button click in FooterActionsViewModel is wrapped in dismissKeyguardThenExecute. FooterActionsInteractor.showForegroundServicesDialog itself is unchanged, so any other caller of that interactor method would not get the keyguard gate. The material shows no such caller.
- The sibling security button handler (onSecurityButtonClicked -> footerActionsInteractor.showDeviceMonitoringDialog) and the observeDeviceMonitoringDialogRequests path are not gated. The material does not show whether that dialog offers any state-changing action, so this is noted only as untouched, not as a flaw.
- The fix relies on dismissKeyguardThenExecute to gate the dialog. The dialog itself adds no further check.
Behavior changes
- When the device is locked, tapping the Quick Settings footer 'active apps' button now prompts the user to unlock. The foreground services dialog opens only after a successful unlock (afterKeyguardGone = true). No cancel action is set (cancelAction = null).
- The FooterActionsViewModel and FooterActionsViewModel.Factory constructor signatures change (new ActivityStarter parameter). This affects Dagger injection and any test or OEM code that constructs them directly.
Per major
- Android 14: same fix: commit 207584fb6f82 (cherry-picked from d7628d5621c9, Change-Id I384699d478e5abcee3a165afc45211b9ed96334a) in android-security-14.0.0_r11. At android-security-14.0.0_r29 the patched region is fully present (8/8 lines).
- Android 15: not affected (not listed by the bulletin); the patched region is fully present at android-security-15.0.0_r17 (8/8 lines).
- Android 16: not affected (not listed by the bulletin); the patched region is fully present at android-security-16.0.0_r8 (8/8 lines).
- Android 17: not affected (not listed by the bulletin); the patched region is fully present at android-security-17.0.0_r1 (8/8 lines).
Unknowns
- The exact name of the patched click handler and its full guard condition are not shown in the diff hunk.
- The Android 13 fix commit and how it was adapted, if at all.
- Whether the foreground services dialog offers actions beyond stopping apps; the material only mentions a VPN app being killable.
- Whether any legacy (non-ViewModel) footer path on affected branches also opens the foreground services dialog.
- How dismissKeyguardThenExecute behaves when the device is already unlocked (whether the dialog opens immediately).