CVE-2024-49740 AI-generated analysis

platform/packages/services/Telephony (PhoneInterfaceManager, visual voicemail SMS filter) and platform/frameworks/base (android.telephony.VisualVoicemailSmsFilterSettings)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (8 corrections). Verify against the commit before relying on it.

Adds server-side enforcement in PhoneInterfaceManager so that only the visual voicemail package (default dialer, system dialer or carrier VVM app) can enable or disable the visual voicemail SMS filter. It also limits the size of VisualVoicemailSmsFilterSettings fields in the Builder: clientPrefix at most 256 chars, originatingNumbers at most 100 entries of at most 256 chars each.

Root cause

PhoneInterfaceManager.enableVisualVoicemailSmsFilter and disableVisualVoicemailSmsFilter only ran mAppOps.checkPackage(Binder.getCallingUid(), callingPackage). They then cleared the calling identity and called VisualVoicemailSmsFilterConfig to apply or remove the caller's filter settings. The API documentation requires the caller to be the default dialer, but the server side did not enforce this (per the commit message), so any package could set filter settings. In addition, VisualVoicemailSmsFilterSettings.Builder accepted a clientPrefix of any length and an originatingNumbers list of any size, with elements of any length. The bulletin classifies the result as a High severity DoS. The material does not show which resource is exhausted.

How the fix works

• platform/frameworks/base ea3337c88a8c, telephony/java/android/telephony/VisualVoicemailSmsFilterSettings.java: adds hidden constants MAX_STRING_LENGTH = 256 and MAX_LIST_SIZE = 100. Builder.setClientPrefix now throws IllegalArgumentException if clientPrefix.length() > 256. Builder.setOriginatingNumbers now throws IllegalArgumentException if the list has more than 100 elements. It also loops over the list and throws IllegalArgumentException for any non-null element longer than 256 characters. Javadoc @throws entries are added for both setters.
• platform/packages/services/Telephony 095be0bb467e, src/com/android/phone/PhoneInterfaceManager.java:enableVisualVoicemailSmsFilter: inserts enforceVisualVoicemailPackage(callingPackage, subId) right after mAppOps.checkPackage and before Binder.clearCallingIdentity. Settings are applied only after the caller is verified as the default dialer, system dialer or carrier visual voicemail app (per the commit message).
• platform/packages/services/Telephony b2c88f00503a (follow-up, android-security-14.0.0_r18), src/com/android/phone/PhoneInterfaceManager.java:disableVisualVoicemailSmsFilter: inserts the same enforceVisualVoicemailPackage(callingPackage, subId) call after mAppOps.checkPackage. This closes the sibling path that the first Telephony commit left unguarded.

Completeness

• At android-security-14.0.0_r29, both mutating entry points (enableVisualVoicemailSmsFilter and disableVisualVoicemailSmsFilter) call enforceVisualVoicemailPackage (code context lines 4088 and 4101).
• The size limits are added only in the public Builder setters. The diff touches no other part of VisualVoicemailSmsFilterSettings. The class implements Parcelable, and the material does not show whether the Parcel-reading path goes through these setters. PhoneInterfaceManager.enableVisualVoicemailSmsFilter does not re-check field sizes in the code shown.
• setOriginatingNumbers skips null elements (num != null), so nulls are still accepted. The list-size error message prints MAX_STRING_LENGTH (256) instead of MAX_LIST_SIZE (100). This is cosmetic only.
• getVisualVoicemailSmsFilterSettings is unchanged and still calls only mAppOps.checkPackage.

Behavior changes

• VisualVoicemailSmsFilterSettings.Builder.setClientPrefix throws IllegalArgumentException for prefixes longer than 256 characters. This is a public API behavior change, documented with @throws.
• VisualVoicemailSmsFilterSettings.Builder.setOriginatingNumbers throws IllegalArgumentException for lists with more than 100 entries or with an element longer than 256 characters.
• ITelephony.enableVisualVoicemailSmsFilter and disableVisualVoicemailSmsFilter now reject callers that are not the visual voicemail package, via enforceVisualVoicemailPackage. The material does not show the exception type or how it reaches the app.

Per major

• Android 14: same fix: frameworks/base ea3337c88a8c and Telephony 095be0bb467e landed in android-security-14.0.0_r16, and the disableVisualVoicemailSmsFilter follow-up b2c88f00503a in android-security-14.0.0_r18. At android-security-14.0.0_r29 all 5/5 lines of the patched region are present and both the enable and disable paths call enforceVisualVoicemailPackage.
• Android 15: same fix: frameworks/base bcb1316835dc (same diff as ea3337c88a8c) in android-security-15.0.0_r4. 8/8 lines of the patched region are present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin). The patched region is present 8/8 at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin). The patched region is present 8/8 at android-security-17.0.0_r1.

Unknowns

• The exact DoS mechanism (which resource is exhausted, or which process fails, when oversized or unauthorized settings are applied) is not shown.
• The implementation of enforceVisualVoicemailPackage and the exception it throws are not in the material.
• The material does not show whether the Parcel-reading path of VisualVoicemailSmsFilterSettings applies any length limits. The diff changes only the Builder.
• The material does not establish which public (non-security) Android 14 tags contain the fix. The index snapshot of enableVisualVoicemailSmsFilter labelled android-14.0.0_r75 lacks enforceVisualVoicemailPackage, but the index may be noisy.

Back to March 2025 · Findings