CVE-2023-40122 AI-generated analysis

platform/frameworks/base, services/autofill (Autofill service UI: SaveUi custom description, inline suggestions)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

Adds user-ownership checks on content URIs in UI content supplied by an autofill service. On Android 14, SaveUi now runs Helper.sanitizeRemoteView on the CustomDescription BatchUpdates RemoteViews. Inline suggestion rendering is skipped when the InlinePresentation Slice contains URI-backed icons owned by a different user (new Helper.sanitizeSlice). sanitizeRemoteView now resolves URIs against the checked userId with the two-argument getUserIdFromUri.

Root cause

Privileged code renders presentation content on behalf of autofill services. Two such inputs were not checked for URI ownership. (1) In SaveUi's custom-description handling, the RemoteViews returned by batchUpdates.getUpdates() were passed directly to reapply(context, customSubtitleView) without Helper.sanitizeRemoteView. (2) In RemoteInlineSuggestionViewConnector.renderSuggestion, the InlinePresentation Slice was forwarded to the remote render service without any inspection of its Icon items. Separately, the existing Helper.sanitizeRemoteView used the one-argument ContentProvider.getUserIdFromUri(uri) instead of the two-argument form with userId as the default. The bulletin classifies the issue as information disclosure (ID), High.

How the fix works

• services/autofill/java/com/android/server/autofill/Helper.java:sanitizeRemoteView: the visitUris lambda now calls android.content.ContentProvider.getUserIdFromUri(uri, userId) (two-argument form) and compares the result with userId.
• services/autofill/java/com/android/server/autofill/Helper.java:sanitizeSlice (new): returns null for a null slice. Otherwise it takes userId = ActivityManager.getCurrentUser() and iterates slice.getItems(). For each SliceItem of FORMAT_IMAGE whose Icon type is TYPE_URI or TYPE_URI_ADAPTIVE_BITMAP, it computes getUserIdFromUri(icon.getUri(), userId). If that differs from userId, it logs a warning and returns null. Otherwise it returns the original slice unchanged. A TODO notes that the slice is not rebuilt without the bad icons because no public API exists to add SliceItems.
• services/autofill/java/com/android/server/autofill/ui/RemoteInlineSuggestionViewConnector.java:renderSuggestion: calls Helper.sanitizeSlice(mInlinePresentation.getSlice()) first. If it returns null, it logs (debug) and returns false before mRemoteRenderService is used. The other hunks in this file only reformat the field annotations.
• services/autofill/java/com/android/server/autofill/ui/SaveUi.java (custom description batch updates, Android 14 commit only): templateUpdates is now Helper.sanitizeRemoteView(batchUpdates.getUpdates()). The existing `if (templateUpdates != null)` guard then skips reapply() for rejected updates.

Completeness

• SaveUi: only the BatchUpdates RemoteViews are sanitized. This commit does not touch the base template (template.applyWithTheme at line 436, template.reapply at line 478 at r29). The material does not show whether the template is sanitized elsewhere.
• sanitizeSlice inspects only top-level slice.getItems() of FORMAT_IMAGE. It does not recurse into nested slices or examine other item formats.
• sanitizeSlice is all-or-nothing: one foreign-user icon suppresses the whole inline suggestion (acknowledged in the TODO).
• sanitizeSlice checks against ActivityManager.getCurrentUser(), not the mUserId field that RemoteInlineSuggestionViewConnector already holds.
• Only two consumers are covered (SaveUi batch updates on 14, inline suggestion slices). The material does not show the state of other autofill presentation paths.
• Google's Android 15 commit has no SaveUi hunk.

Behavior changes

• Inline suggestions whose Slice contains a URI-backed Icon owned by a user other than the current user are no longer rendered: renderSuggestion returns false. A null Slice also makes renderSuggestion return false.
• SaveUi custom-description batch updates whose RemoteViews reference URIs of another user are skipped silently. Transformations in the same batch still apply.
• Helper.sanitizeRemoteView now evaluates URI ownership with getUserIdFromUri(uri, userId), so URIs without an explicit user prefix are attributed to userId (general platform knowledge about the default parameter).
• sanitizeSlice logs a new warning line when it finds a foreign-user icon.

Per major

• Android 14: Same fix: platform/frameworks/base 55fc00a0788e in android-security-14.0.0_r5 (cherry-pick of df893defcf8cc6e1e223111e79ad3daf0ec7cd8b). It covers Helper, RemoteInlineSuggestionViewConnector and SaveUi. 8/8 lines of the patched region are present at android-security-14.0.0_r29.
• Android 15: Adapted fix: platform/frameworks/base 2d1d69e1571c in android-security-15.0.0_r5. It contains the Helper changes (sanitizeRemoteView two-argument getUserIdFromUri, new sanitizeSlice) and the renderSuggestion guard, but no SaveUi hunk. One context line differs: `allowed & permissionsOk.get()` on 15 vs `&&` on 14. 8/8 lines are present at android-security-15.0.0_r17.
• Android 16: Not affected (the bulletin does not list Android 16). The patched region is present at android-security-16.0.0_r8.
• Android 17: Not affected (the bulletin does not list Android 17). The patched region is present at android-security-17.0.0_r1.

Unknowns

• Whether the SaveUi base template is sanitized elsewhere.
• Why the Android 15 commit has no SaveUi change, and whether the 15 SaveUi batch-update path already calls sanitizeRemoteView.
• Whether other autofill presentation paths perform equivalent URI checks.
• The concrete disclosure impact; the bulletin gives only type ID, severity High.
• Why b/286235483 and b/292104015 are both fixed by one change.

Back to February 2025 · Findings