CVE-2024-40677 AI-generated analysis

platform/packages/apps/Settings, fuelgauge (App battery usage detail, AdvancedPowerUsageDetail)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

The Settings fragment AdvancedPowerUsageDetail (App battery usage detail page) now overrides shouldSkipForInitialSUW() to return true, so the page is not allowed to launch before the setup flow completes. This is described as an FRP bypass defense.

Root cause

AdvancedPowerUsageDetail extends DashboardFragment and did not override shouldSkipForInitialSUW() to return true. Per the commit message and test, the app battery usage app info page could therefore be launched (via ADB in the test) during setup after a factory reset, which defeats Factory Reset Protection. The base-class default and its enforcement are not shown in the material.

How the fix works

• src/com/android/settings/fuelgauge/AdvancedPowerUsageDetail.java: adds an override `protected boolean shouldSkipForInitialSUW() { return true; }` between onResume() and onPause(). This opts the fragment into an existing Settings hook. The base-class code that acts on the hook is not in the diff.
• tests/robotests/src/com/android/settings/fuelgauge/AdvancedPowerUsageDetailTest.java: adds shouldSkipForInitialSUW_returnTrue, which asserts that the override returns true.

Completeness

• Covers only the AdvancedPowerUsageDetail fragment. The fix is a single boolean override and relies entirely on the base fragment enforcing shouldSkipForInitialSUW(). That enforcement is not shown in the material.
• The commit touches no other fuelgauge or Settings pages. The material does not show whether other fragments reachable during setup lack the same override.
• The commit is marked RESTRICT AUTOMERGE and is a cherry-pick of commit 419a6a907902. It adds no logic beyond the override.

Behavior changes

• While the setup flow has not completed, launching the App battery usage detail page (AdvancedPowerUsageDetail) now closes the page instead of showing it. Commit test: 'launch app battery usage app info via ADB during Setup -> verify app closes'.
• After setup completes, behavior is expected to be unchanged, but this depends on base-class code that is not shown.

Per major

• Android 14: same fix: commit db26138f07db (RESTRICT AUTOMERGE cherry-pick of 419a6a907902) in android-security-14.0.0_r13. At android-security-14.0.0_r29, all 4 lines of the patched region are present.
• Android 15: not affected per the bulletin. At android-security-15.0.0_r17, 3 of the 4 lines of the patched region are present. The material does not show whether the override is fully present or which commit carried it.
• Android 16: not affected per the bulletin. At android-security-16.0.0_r8, 3 of the 4 lines of the patched region are present. Whether the override is fully present is not shown.
• Android 17: not affected per the bulletin. At android-security-17.0.0_r1, 3 of the 4 lines of the patched region are present. Whether the override is fully present is not shown.

Unknowns

• The base-class code that acts on shouldSkipForInitialSUW() is not in the material: where it is checked, which setup or provisioning state it tests, and how it closes the page.
• The exact intent or entry point used to launch the page during setup is not shown beyond 'via ADB' in the commit message.
• Which commit, if any, carried the fix into the 15, 16 and 17 lines, and why one of the four patched lines differs there, is not shown.

Back to October 2024 · Findings