CVE-2024-40659 AI-generated analysis
platform/packages/modules/RemoteKeyProvisioning (rkpdapp, RemoteProvisioningService); companion permission definition in platform/frameworks/base core/res/AndroidManifest.xml (Android 15)
Restricts the exported rkpdapp RemoteProvisioningService so that only system_server (SYSTEM_UID) or rkpdapp itself can use the getRegistration API. It does this by adding a BIND_RKP_SERVICE permission to the service in the manifest and a calling-UID check in the binder implementation.
Root cause
In app/AndroidManifest.xml the service .service.RemoteProvisioningService was declared android:exported="true" with an intent-filter for com.android.rkpdapp.IRemoteProvisioning and had no android:permission attribute. Its IRemoteProvisioning.Stub implementation in RemoteProvisioningService.java did not check who was calling. Any process could therefore bind to the service and reach the getRegistration path, which goes on to call ServiceManagerInterface.getInstance(irpcName). The new error message shows this API was meant only for system_server and rkpdapp itself. The bulletin classifies the impact as DoS (High).
How the fix works
- app/AndroidManifest.xml: the <service android:name=".service.RemoteProvisioningService"> element gains android:permission="android.permission.BIND_RKP_SERVICE" and stays exported, so a client must hold that permission to bind.
- app/src/com/android/rkpdapp/service/RemoteProvisioningService.java (IRemoteProvisioning.Stub implementation, getRegistration path per the commit title and the irpcName/IGetRegistrationCallback context): after the existing early-return validation, a new check compares Binder.getCallingUid() with Process.SYSTEM_UID and Process.myUid(). If the caller matches neither, the code calls callback.onError("Only system server and self are allowed to call RKP service.") and returns before ServiceManagerInterface.getInstance(irpcName) runs. The imports android.os.Binder and android.os.Process are added.
- platform/frameworks/base core/res/AndroidManifest.xml (commit fb65afa14cdd, android-15.0.0_r1): defines the @hide permission android.permission.BIND_RKP_SERVICE with android:protectionLevel="signature".
Completeness
- The fix adds two layers. The manifest permission gates binding to the service component. The UID check gates the getRegistration binder method itself, so even a caller that binds cannot get past that check unless it runs as SYSTEM_UID or rkpdapp's own UID.
- The diff places the UID check only on the getRegistration path. The material does not show whether IRemoteProvisioning has other methods, so coverage of other binder entry points cannot be judged.
- The new check comes after an existing early return whose content the diff does not show.
- The permission definition (BIND_RKP_SERVICE, signature) appears only in the Android 15 frameworks/base commit. The material does not show a matching definition on the Android 14 branch.
Behavior changes
- Binding to com.android.rkpdapp/.service.RemoteProvisioningService now requires android.permission.BIND_RKP_SERVICE.
- When a UID other than SYSTEM_UID or rkpdapp's own UID calls getRegistration, the call now ends with callback.onError("Only system server and self are allowed to call RKP service.").
- On Android 15, the platform defines a new @hide signature-level permission, android.permission.BIND_RKP_SERVICE.
Per major
- Android 14: same fix: RemoteKeyProvisioning commit c65dce4c6d8d (RESTRICT AUTOMERGE, cherry-pick of internal d9c9db03) in android-security-14.0.0_r12. It adds the manifest permission attribute and the UID check. All 8/8 patched lines are present at android-security-14.0.0_r29. The material shows no frameworks/base permission definition for 14.
- Android 15: adapted fix: the BIND_RKP_SERVICE permission is defined in platform/frameworks/base commit fb65afa14cdd (core/res/AndroidManifest.xml, signature protectionLevel) in android-15.0.0_r1. 4/4 lines are present at android-security-15.0.0_r17. The material does not show the rkpdapp-side change for 15.
- Android 16: not affected per the bulletin; 8/8 lines of the patched region are present at android-security-16.0.0_r8.
- Android 17: not affected per the bulletin; 8/8 lines of the patched region are present at android-security-17.0.0_r1.
Unknowns
- Whether the BIND_RKP_SERVICE permission definition in frameworks/base was also applied to the Android 14 branch; the material only shows it for Android 15.
- Whether the rkpdapp manifest/UID-check change is present on Android 15; the material only shows the frameworks/base commit for 15.
- The exact method signature of getRegistration, any other methods of IRemoteProvisioning, and what the early-return validation before the new UID check does.
- The exact DoS mechanism the bulletin refers to; the material only shows the access-control gap.