CVE-2024-43086 AI-generated analysis
platform/frameworks/base, services/core AccountManagerService (accounts)
Adds an else-if branch to the authenticator validation loop in AccountManagerService so that when a TABLE_META entry (type -> uid) still has an installed uid but the currently registered authenticator for that type belongs to a different uid, the stale type is marked obsolete, its meta row is deleted, and accounts of that type are purged.
Root cause
In services/core/java/com/android/server/accounts/AccountManagerService.java, the loop that reconciles persisted TABLE_META entries (authToUidEntry: type -> uid) against the currently cached authenticators (knownAuth) only purged an entry when the old uid no longer had any installed or updated package (!knownUids.get(uid)). If the old uid's package was still present (for example the authenticator was disabled rather than uninstalled, per the commit title) and a different uid now registered an authenticator for the same type, the entry fell through without action: the type was not added to obsoleteAuthType, the meta row was not deleted, and the existing accounts of that type were kept while the new authenticator uid was written by insertOrReplaceMetaAuthTypeAndUid. The bulletin rates this High / ID (information disclosure).
How the fix works
- services/core/java/com/android/server/accounts/AccountManagerService.java, authenticator reconciliation loop (iterates authToUidEntry against knownAuth; method name not shown in the material): after the existing `if (!knownUids.get(uid))` purge branch, a new `else if (knownUid != null && knownUid != uid)` branch is added.
- The new branch logs Slog.w(TAG, "authenticator no longer exist for type " + type), adds the type to obsoleteAuthType, and calls accountsDb.deleteMetaByAuthTypeAndUid(type, uid) for the old uid, mirroring the existing purge path.
- Downstream, the existing account loop deletes every account whose type is in obsoleteAuthType ("deleting account ... because type ...'s registered authenticator no longer exist."), and the loop over knownAuth.entrySet() records the new (type, newUid) mapping via insertOrReplaceMetaAuthTypeAndUid, so the type no longer keeps the accounts created under the old authenticator.
Completeness
- Covers the case where the type's registered authenticator uid changed (knownUid != null && knownUid != uid) while the old uid is still installed.
- Does not change the case knownUid == null with the old uid still installed (type has no current authenticator but the package is still present): data is still retained, consistent with the existing comment that this is an imperfect signal the package may be updating.
- Does not change the pre-existing caveat noted in the code comment that an authenticator sharing a uid with other apps is not wiped while any app with that uid remains.
- Single-file, single-hunk change; no other call sites or sibling paths are touched in the material.
Behavior changes
- When an account type's authenticator moves to a different uid, all existing accounts of that type are now deleted during validation (new Slog.w warnings for the type and each deleted account).
- The old (type, uid) TABLE_META row is removed before the new mapping is inserted.
- Purge now triggers even when the old uid still has an installed or updated package on the device.
Per major
- Android 14: same fix: commit 55a3d36701bb in android-security-14.0.0_r14 (cherry-pick of ddfc078af7e8); patched region fully present (3/3 lines) at android-security-14.0.0_r29.
- Android 15: not affected per the bulletin (Android 15 not listed); patched region present (3/3 lines) at android-security-15.0.0_r17.
- Android 16: not affected per the bulletin; patched region present (3/3 lines) at android-security-16.0.0_r8.
- Android 17: not affected per the bulletin; patched region present (3/3 lines) at android-security-17.0.0_r1.
Unknowns
- The enclosing method name is not shown in the provided code context.
- The exact trigger scenario and what information is disclosed are not described in the material beyond the commit title and the bulletin's ID classification.
- No automated test accompanies the change (Test: manual).
- The loop shape on Android 12, 12L and 13 is not shown.