CVE-2024-43090 AI-generated analysis

platform/frameworks/base, SystemUI keyboard shortcut helper (KeyboardShortcuts / KeyboardShortcutListSearch) and android.view.KeyboardShortcutInfo

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (8 corrections). Verify against the commit before relying on it.

SystemUI's keyboard shortcut helper now strips any Icon carried in app-provided KeyboardShortcutInfo objects before the shortcuts are displayed. It does this through a new @hide KeyboardShortcutInfo.clearIcon(), called from a new KeyboardShortcuts.sanitiseShortcuts() helper.

Root cause

KeyboardShortcutInfo is a Parcelable whose mIcon field can be populated by the providing app. The commit message notes this is only possible via reflection and is not intended for use outside the system. SystemUI requested the focused app's shortcuts via WindowManager.requestAppKeyboardShortcuts. Per index search, the result reached KeyboardShortcuts.showKeyboardShortcuts / KeyboardShortcutListSearch.showKeyboardShortcuts via WindowManagerImpl.requestAppKeyboardShortcuts -> IResultReceiver.send -> onKeyboardShortcutsReceived. From there it was passed unchanged to showKeyboardShortcutsDialog or reMapToKeyboardShortcutMultiMappingGroup, so an app-controlled Icon reached the SystemUI shortcut helper. On Android 15 the governing flag is named validateKeyboardShortcutHelperIconUri, which hints that the concern is app-supplied icon URIs. The bulletin rates this as High ID.

How the fix works

• core/java/android/view/KeyboardShortcutInfo.java: mIcon is no longer final, and a new @hide method clearIcon() sets mIcon = null.
• packages/SystemUI/src/com/android/systemui/statusbar/KeyboardShortcuts.java: a new package-private static sanitiseShortcuts(List<KeyboardShortcutGroup>) walks every group and every KeyboardShortcutInfo in group.getItems() and calls info.clearIcon(). In showKeyboardShortcuts(int), the onKeyboardShortcutsReceived callback now calls sanitiseShortcuts(result) first. Only after that does it append getSystemShortcuts()/getDefaultApplicationShortcuts() and run showKeyboardShortcutsDialog(result). As a result only the app-provided groups are stripped.
• packages/SystemUI/src/com/android/systemui/statusbar/KeyboardShortcutListSearch.java: in showKeyboardShortcuts(int), the non-empty branch of onKeyboardShortcutsReceived calls KeyboardShortcuts.sanitiseShortcuts(result) before reMapToKeyboardShortcutMultiMappingGroup(result) builds mSpecificAppGroup.
• Android 15 (f1a15b5ef253): the sanitiseShortcuts() calls already existed there but were gated by Flags.validateKeyboardShortcutHelperIconUri. The fix removes the flag checks, so sanitisation is unconditional in KeyboardShortcuts (app and IME result handlers) and in KeyboardShortcutListSearch (specific-app and IME branches). It also removes the @EnableFlags annotations from the corresponding tests.

Completeness

• On Android 14 the commit covers the two SystemUI consumers of requestAppKeyboardShortcuts shown in the material (KeyboardShortcuts and KeyboardShortcutListSearch). It clears the icon on every item of every returned group.
• The mitigation is applied at the consumer (SystemUI), not where the data is produced or relayed. KeyboardShortcutInfo still parcels and unparcels an app-set Icon, and the commit does not change the system_server path. Any other consumer of these icons is therefore not covered by this commit.
• The Android 14 commit sanitises only the app-shortcut result path. The Android 15 commit also sanitises IME shortcut results. The Android 14 code shown has no IME shortcut request in these two classes, so the material does not show whether such a path exists on 14 or whether it is unsanitised.
• The removal is coarse: no URI validation is attempted, and all app-provided icons are dropped.

Behavior changes

• Shortcuts provided by the focused app appear in the SystemUI shortcut helper without any icon. The system and default-application groups that SystemUI builds itself are added after sanitisation and are not affected.
• KeyboardShortcutInfo gains a @hide mutator clearIcon(), and mIcon is no longer final.
• On Android 15, sanitisation no longer depends on the validateKeyboardShortcutHelperIconUri flag.

Per major

• Android 14: Same fix: commit 4677d3ee0ec2 (RESTRICT AUTOMERGE, cherry-picked from internal commit 8dc5ed150f2c) in android-security-14.0.0_r14 adds clearIcon(), sanitiseShortcuts() and the two call sites. 8/8 lines of the patched region are present at android-security-14.0.0_r29.
• Android 15: Adapted fix: commit f1a15b5ef253 (RESTRICT AUTOMERGE) in android-security-15.0.0_r6 removes the validateKeyboardShortcutHelperIconUri flag gate around existing sanitiseShortcuts() calls, for both app and IME shortcut results, and updates the tests. 7/8 lines of the patched region are present at android-security-15.0.0_r17; the material does not explain the one-line difference.
• Android 16: Not affected (not listed by the bulletin). 8/8 lines of the patched region are present at android-security-16.0.0_r8.
• Android 17: Not affected (not listed by the bulletin). 8/8 lines of the patched region are present at android-security-17.0.0_r1.

Unknowns

• The material does not show how the Icon is rendered in the dialog or what information is disclosed. The only hints are the ID classification and the Android 15 flag name (validateKeyboardShortcutHelperIconUri).
• It is not shown whether Android 14 SystemUI has an IME keyboard shortcut path that would need the same treatment.
• It is not shown whether there are other Android 14 consumers of requestAppKeyboardShortcuts beyond the two classes patched.
• The nature of the one-line difference in the patched region at android-security-15.0.0_r17 is not shown.
• It is not shown whether the flag-gated code that already existed on Android 15 shipped with the flag enabled.

Back to March 2025 · Findings