CVE-2024-40656 AI-generated analysis
platform/packages/services/Telecomm, ConnectionServiceWrapper (ConnectionService adapter callbacks)
Adds a cross-user validation of the StatusHints icon carried by a ParcelableConference in ConnectionServiceWrapper's handleCreateConferenceComplete callback. It uses the Binder calling user, captured before the calling identity is cleared.
Root cause
In src/com/android/server/telecom/ConnectionServiceWrapper.java, handleCreateConferenceComplete(String callId, ConnectionRequest request, ParcelableConference conference, Session.Info sessionInfo) accepted the ParcelableConference from the ConnectionService, cleared the Binder calling identity and forwarded the conference without checking that the Icon in its StatusHints belonged to the calling user. Per the commit message, a conference call could therefore display an image from another user.
How the fix works
- src/com/android/server/telecom/ConnectionServiceWrapper.java, handleCreateConferenceComplete (in the ConnectionService adapter inside ConnectionServiceWrapper): the fix captures `UserHandle callingUserHandle = Binder.getCallingUserHandle()` before `Binder.clearCallingIdentity()`. This records the caller's user even though the rest of the method runs with cleared identity.
- Same method, inside `synchronized (mLock)`: if `conference.getStatusHints() != null`, the fix reads the Icon and replaces it with `StatusHints.validateAccountIconUserBoundary(icon, callingUserHandle)` via `setIcon(...)`. This matches the check visible in handleCreateConnectionComplete at android-security-14.0.0_r29.
- The fix is a single commit: 7 inserted lines in one file.
Completeness
- Covers the conference creation completion path (handleCreateConferenceComplete), and only for the StatusHints icon. At r29, the connection creation path (handleCreateConnectionComplete) has the same check. The material does not show when that check was added.
- Only the icon inside StatusHints is validated. The change touches no other fields of ParcelableConference.
- The material does not show whether other ConnectionService-to-Telecom paths that can deliver StatusHints do the same validation.
- The material does not include how StatusHints.validateAccountIconUserBoundary behaves.
Behavior changes
- Status hint icons in a ParcelableConference delivered by a ConnectionService now pass through StatusHints.validateAccountIconUserBoundary against the calling user. An icon that fails the check is replaced by whatever that helper returns (its body is not shown).
- Binder.getCallingUserHandle() is now read at the start of the callback. The diff adds no new error codes or exceptions.
Per major
- Android 14: same fix: cherry-picked as f3e6a6c02439 into android-security-14.0.0_r12 (linked by bug 329058967). At android-security-14.0.0_r29, all 8 lines of the patched region are present. The check now sits after the mScheduledFutureMap lookup, which also has a `call != null` guard there.
- Android 15: same fix: present as 8c619f58c000 in the android-15.0.0_r1 base with an identical hunk. All 8 lines are present at android-security-15.0.0_r17.
- Android 16: not affected (not listed by the bulletin). The patched region is present (8/8 lines) at android-security-16.0.0_r8.
- Android 17: not affected (not listed by the bulletin). The patched region is present (8/8 lines) at android-security-17.0.0_r1.
Unknowns
- The material does not include the implementation of StatusHints.validateAccountIconUserBoundary or what it returns for a rejected icon.
- The material does not show whether other paths that deliver StatusHints from a ConnectionService to Telecom carry the same validation.
- The material does not show when the matching check in handleCreateConnectionComplete was introduced.
- The material does not show how the unvalidated icon was loaded or rendered downstream.