CVE-2024-43087 AI-generated analysis

platform/packages/apps/Settings, accessibility settings UI (AccessibilitySettings fragment)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

Removes the deduplication in Settings' AccessibilitySettings that dropped an installed accessibility service from the accessibility preference list whenever an accessibility shortcut activity in the same package had the same label, so every installed service is now listed.

Root cause

In AccessibilitySettings, the method that builds the installed accessibility preference list (around line 416) copied a11yManager.getInstalledAccessibilityServiceList() into installedServiceList and then called installedServiceList.removeIf(target -> containsTargetNameInList(installedShortcutList, target)). containsTargetNameInList compared the service's ServiceInfo.packageName and loadLabel() with each AccessibilityShortcutInfo's ActivityInfo.packageName and loadLabel(). When they matched, the service was removed from the list shown to the user. An app that declared an accessibility shortcut activity with the same label as its accessibility service could therefore have the service left off the Accessibility settings list.

How the fix works

• src/com/android/settings/accessibility/AccessibilitySettings.java (preference list builder around line 416): deletes the installedServiceList.removeIf(... containsTargetNameInList(...)) call. The list passed to preferenceHelper.createAccessibilityServicePreferenceList(installedServiceList) is now the full, unfiltered copy of a11yManager.getInstalledAccessibilityServiceList().
• src/com/android/settings/accessibility/AccessibilitySettings.java: removes the private helper containsTargetNameInList(List<AccessibilityShortcutInfo>, AccessibilityServiceInfo) and the import android.content.pm.ServiceInfo, which is no longer used.
• Activity preferences are still built from installedShortcutList via preferenceHelper.createAccessibilityActivityPreferenceList. Only the service-side filtering is removed. The material shows a single commit (RESTRICT AUTOMERGE cherry-pick, Change-Id Ia8d43229d277dd4442173166ae0402f05096da4b).

Completeness

• The fix removes the label/package based hiding path in AccessibilitySettings. No code left in the diffed region removes services from the displayed list.
• The fix only touches the main Accessibility list in the Settings app. The material does not show other Settings screens or other consumers of getInstalledAccessibilityServiceList, so it cannot show whether a similar deduplication exists elsewhere.
• The fix does not change the a11y framework (AccessibilityManager) or the shortcut list. It only changes what Settings displays.

Behavior changes

• Accessibility settings now lists every installed accessibility service, even when the same package also exposes an accessibility shortcut activity with the same label. Such a package now shows two entries (one activity, one service) where before only the activity entry appeared.
• The containsTargetNameInList helper and the ServiceInfo import are removed. There are no new error paths.

Per major

• Android 14: same fix: commit 6253b87704bb (RESTRICT AUTOMERGE cherry-pick) in android-security-14.0.0_r14. At android-security-14.0.0_r29 all 8/8 lines of the patched region are present.
• Android 15: not affected per the bulletin. At android-security-15.0.0_r17 the patched region is present (8/8 lines), so the branch already carries the fixed code.
• Android 16: not affected per the bulletin. At android-security-16.0.0_r8 the patched region is present (8/8 lines).
• Android 17: not affected per the bulletin. At android-security-17.0.0_r1 the patched region is present (8/8 lines).

Unknowns

• The exact commits used for Android 12, 12L and 13 are not in the material. Only the Android 14 cherry-pick is shown.
• The bulletin's affected-version list includes '15-next', but the per-major facts say Android 15 is not listed. The material does not explain the difference.
• The material does not show whether other Settings code paths (e.g. search indexing or other accessibility screens) apply a similar package+label deduplication.
• The material does not show the permissions an app needs to declare these components.
• The PoC APK behaviour referenced in the commit message (bug 353700779) is not included in the material.

Back to November 2024 · Findings