CVE-2024-40655 AI-generated analysis

platform/packages/services/Telecomm, outgoing call screening (CallScreeningServiceHelper)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Adds an unbindService() call to the call-screening timeout handler in Telecom's CallScreeningServiceHelper so that a CallScreeningService that never responds is released after the timeout instead of staying bound.

Root cause

CallScreeningServiceHelper.bindAndGetCallIdentification() binds to the ROLE_CALL_SCREENING holder's service and posts a timeout runnable (Timeouts.getCallScreeningTimeoutMillis). Before the fix, the timeout runnable only completed mFuture with null and ended the log session. It never called unbindService(serviceConnection). Per the commit message, the code assumed the service would use MSG_SCREEN_CALL to screen the call and that the connection would be unbound for outgoing calls once screening completed. A plain service holding ROLE_CALL_SCREENING that does not complete screening therefore stayed bound by Telecom after the timeout, which kept the service alive. The onNullBinding path already unbound (line 156 in context). The timeout path did not.

How the fix works

• src/com/android/server/telecom/CallScreeningServiceHelper.java:bindAndGetCallIdentification (timeout runnable posted via handler.postDelayed): after mFuture.complete(null), adds mContext.unbindService(serviceConnection) so the binding is torn down when the timeout fires.
• Same runnable: adds a catch (IllegalArgumentException e) that logs via Log.i(this, "Exception when unbinding service %s : %s", ...). This absorbs the exception that Context.unbindService throws when the connection is not currently bound (for example, already unbound by another path, or the original bind failed). The finally { Log.endSession(); } block is unchanged.
• Single-commit fix. Android 14 received it as a cherry-pick (Change-Id I30d276867c571ece113106d3b363fce99d64f441, cherry-picked from 9d97cd5825066ac8e15bbf97f6755663c5341afb).

Completeness

• Covers the timeout path of the outgoing-call screening binding in CallScreeningServiceHelper. Together with the existing unbind in onNullBinding, the connection is now released on null binding and on timeout. The normal response path is not visible in the material.
• The unbind in the timeout runnable is unconditional: it runs even if mFuture already completed. It relies on the new IllegalArgumentException catch for the already-unbound case.
• Only the CallScreeningServiceHelper (outgoing call identification) binding is touched. The material does not show whether other Telecom code paths that bind a CallScreeningService (for example, incoming-call screening) have their own timeout/unbind handling.
• The timeout duration itself (Timeouts.getCallScreeningTimeoutMillis) is unchanged. The service can still stay bound for up to that timeout per outgoing call.

Behavior changes

• When the call-screening timeout fires, Telecom now calls unbindService on the CallScreeningService connection. Per the commit's manual test, the service's onDestroy is called after the timeout.
• A new Log.i line is emitted if unbindService throws IllegalArgumentException.
• No change to the timeout value or the future result: mFuture is still completed with null on timeout.

Per major

• Android 14: same fix: cherry-pick eeef54b37a36 of the same 4-line change in android-security-14.0.0_r12 (linked by bug 300904123). All 3 patched lines are present at android-security-14.0.0_r29.
• Android 15: same fix: original commit 9d97cd582506 is in the base release android-15.0.0_r1. The patched region is present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin). The patched region is present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin). The patched region is present at android-security-17.0.0_r1.

Unknowns

• The material does not show the onServiceConnected path of this ServiceConnection, so how the connection is unbound on the normal (service responds) path is not visible.
• The material does not show whether other CallScreeningService binding sites in Telecom (incoming call screening) share the same missing-unbind pattern.
• The material does not show how outgoing calls from TelecomManager.placeCall reach CallScreeningServiceHelper.
• The material does not detail the concrete impact of the kept-alive service beyond keeping the service alive (the bulletin rates it High EoP).

Back to September 2024 · Findings