CVE-2024-43084 AI-generated analysis

platform/frameworks/base, Notification / Person / RemoteViews URI visiting (core/java/android/app, core/java/android/widget)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (10 corrections). Verify against the commit before relying on it.

Extends Notification.visitUris so that each Person's own URI (mUri) is visited along with its icon URI, including the senders of MessagingStyle messages, and so that RemoteViews nested inside two list/collection adapter actions are visited, for URI permission grant handling.

Root cause

Notification.visitUris(Consumer<Uri>) enumerates the URIs referenced by a notification. The Person.visitUris javadoc says these URIs need URI permission grants so the recipient can render the content. For Person objects (EXTRA_PEOPLE_LIST, EXTRA_MESSAGING_PERSON, the senders of messages in EXTRA_MESSAGES and EXTRA_HISTORIC_MESSAGES, EXTRA_CALL_PERSON), it called only visitor.accept(getIconUri()), so the Person's mUri string was never visited. In RemoteViews, the action with tag SET_REMOTE_VIEW_ADAPTER_LIST_TAG (holding ArrayList<RemoteViews> list) and the action with tag SET_REMOTE_COLLECTION_ITEMS_ADAPTER_TAG (holding mItems) had no visitUris override, so URIs in their nested RemoteViews were not visited. The bulletin classifies the issue as information disclosure (ID).

How the fix works

• core/java/android/app/Person.java: adds the hidden method Person.visitUris(Consumer<Uri>). It calls visitor.accept(getIconUri()), then calls visitor.accept(Uri.parse(mUri)) when mUri is non-null and non-empty.
• core/java/android/app/Notification.java: Notification.visitUris now calls p.visitUris(visitor) for each Person in EXTRA_PEOPLE_LIST, person.visitUris(visitor) for EXTRA_MESSAGING_PERSON and callPerson.visitUris(visitor) for EXTRA_CALL_PERSON. These replace the previous visitor.accept(...getIconUri()) calls.
• core/java/android/app/Notification.java: adds the hidden method MessagingStyle.Message.visitUris(Consumer<Uri>). It visits getDataUri() and, if mSender != null, delegates to mSender.visitUris(visitor). The EXTRA_MESSAGES and EXTRA_HISTORIC_MESSAGES loops now call message.visitUris(visitor) instead of inlining the data URI and the sender icon URI.
• core/java/android/widget/RemoteViews.java: the action returning SET_REMOTE_VIEW_ADAPTER_LIST_TAG gains an @Override visitUris that calls remoteViews.visitUris(visitor) for each RemoteViews in list.
• core/java/android/widget/RemoteViews.java: the action returning SET_REMOTE_COLLECTION_ITEMS_ADAPTER_TAG gains an @Override visitUris that calls mItems.visitUris(visitor) when mItems != null. A nested class holding mViews/mViewTypeCount gains a private visitUris that calls view.visitUris(visitor) for each view in mViews.

Completeness

• Covers every Person reference visited in Notification.visitUris (people list, messaging person, message senders for current and historic messages, call person): both the icon URI and mUri are now visited.
• Covers nested RemoteViews reachable through the two adapter actions (list, and mItems via mViews). The diff does not change any other RemoteViews action.
• Other extras in Notification.visitUris (EXTRA_AUDIO_CONTENTS_URI, EXTRA_BACKGROUND_IMAGE_URI, RemoteInputHistoryItem.getUri, icons) are not changed by this diff.
• Person.visitUris visits only the icon URI and mUri. Message.visitUris visits only getDataUri() and the sender Person.

Behavior changes

• The URI visitor now receives additional URIs: Person.mUri (parsed with Uri.parse) for the Person objects listed above, and the URIs of RemoteViews nested in the two adapter actions. Whatever the visitor does with URIs now also applies to these.
• New hidden methods: Person.visitUris and Notification.MessagingStyle.Message.visitUris. Also added: a private visitUris on the collection-items class and two Action.visitUris overrides in RemoteViews.

Per major

• Android 14: same fix: commit 50eec20b570c in android-security-14.0.0_r14 (cherry-pick of f47b41a138eb that includes changes from 57bf60dd7b6a and 47fa2f79584b). At android-security-14.0.0_r29, 6/8 lines of the patched region are present; the material does not show which lines differ.
• Android 15: not affected (not listed by the bulletin). 6/8 lines of the patched region are present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin). 6/8 lines of the patched region are present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin). 6/8 lines of the patched region are present at android-security-17.0.0_r1.

Unknowns

• The material does not show the consumer side: how the system uses the visited URIs (grant or check), or whether notifications can now be rejected.
• The exact disclosure scenario from bug 281044385 is not shown.
• The three upstream commits (f47b41a138eb, 57bf60dd7b6a, 47fa2f79584b) are not shown separately.
• Which 2 of the 8 patched-region lines differ at the latest tag of each major is not shown.
• The RemoteViews class names of the two modified actions and of the collection-items class are not shown in the diff.

Back to November 2024 · Findings