CVE-2024-43762 AI-generated analysis
platform/frameworks/base, AppWidget service (services/appwidget AppWidgetServiceImpl) and core/java/android/widget/RemoteViewsAdapter
Adds ServiceConnection.onNullBinding() overrides to three service connections in the app widget stack (RemoteViewsAdapter and two anonymous connections in AppWidgetServiceImpl), so that a service whose onBind() returns null gets unbound.
Root cause
The ServiceConnection objects in AppWidgetServiceImpl called mContext.unbindService(this) only from onServiceConnected(), and the RemoteViewsAdapter connection did not override onNullBinding(). When the target service's onBind() returns null, the framework calls onNullBinding() instead of onServiceConnected(), so no unbind took place. In AppWidgetServiceImpl.destroyRemoteViewsService the bind uses mContext.bindServiceAsUser(intent, conn, BIND_AUTO_CREATE | BIND_FOREGROUND_SERVICE_WHILE_AWAKE, widget.provider.id.getProfile()) under Binder.clearCallingIdentity(), so a null-binding service was left bound with those flags. The second anonymous ServiceConnection in AppWidgetServiceImpl (hunk near line 2014) and the RemoteViewsAdapter connection also lacked onNullBinding. The bulletin rates this as a High severity EoP.
How the fix works
- core/java/android/widget/RemoteViewsAdapter.java, inner ServiceConnection/Handler.Callback class (next to onServiceDisconnected): adds onNullBinding(ComponentName), which calls enqueueDeferredUnbindServiceMessage(). This reuses the deferred-unbind path that the MSG_REQUEST_BIND and MSG_NOTIFY_DATA_SET_CHANGED handlers already use.
- services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java:destroyRemoteViewsService: the anonymous ServiceConnection gains onNullBinding(ComponentName), which immediately calls mContext.unbindService(this), the same call onServiceConnected makes after cb.onDestroy(intent).
- services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java, second anonymous ServiceConnection (hunk near original line 2014; the material does not show the enclosing method): the same onNullBinding override calling mContext.unbindService(this).
- The change only adds code (15 lines, nothing removed) and does not change onServiceConnected or onServiceDisconnected.
Completeness
- Covers the null-binding case for all three ServiceConnection implementations in the diff; each one now releases the binding when onBind() returns null.
- onServiceDisconnected stays a no-op in both AppWidgetServiceImpl connections, and none of the three connections overrides onBindingDied. The material does not show whether those paths matter for this issue.
- No change to how or when the binds are started (flags, clearCallingIdentity, profile selection) in AppWidgetServiceImpl; the fix only makes sure the binding is released after a null binding.
Behavior changes
- A service whose onBind() returns null is now unbound right away by AppWidgetServiceImpl, or through the deferred unbind message in RemoteViewsAdapter, instead of staying bound.
- In RemoteViewsAdapter, a null binding now schedules the same deferred unbind used after normal operations; callers see no new error.
Per major
- Android 14: same fix: commit ae43ac7f3d3d in android-security-14.0.0_r15 (cherry-pick of d406f4708e39, Change-Id I12fccb572e159a73785aa33a4f5204e094ccd1b7); all 6 lines of the patched region are present at android-security-14.0.0_r29.
- Android 15: not affected (not listed by the bulletin); all 6 lines of the patched region are present at android-security-15.0.0_r17.
- Android 16: not affected (not listed by the bulletin); all 6 lines of the patched region are present at android-security-16.0.0_r8.
- Android 17: not affected (not listed by the bulletin); all 6 lines of the patched region are present at android-security-17.0.0_r1.
Unknowns
- The enclosing method of the second AppWidgetServiceImpl hunk (near line 2014), and which service it binds, are not shown in the material.
- The material does not describe the concrete privilege-escalation consequence of the leaked binding beyond the bulletin's High/EoP rating and the commit's mention of a PoC app.
- The per-major facts provided do not say whether the fix was also applied to the Android 12, 12L and 13 branches.