CVE-2025-22419 AI-generated analysis

platform/packages/services/Telephony, com.android.phone settings/FDN/SIM PIN/EmergencyDialer activities

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

Adds WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS to the activity window in onCreate of 18 Telephony (com.android.phone) settings, SIM PIN, FDN, SIM contacts and emergency dialer activity classes so non-system overlay windows are not shown over them.

Root cause

The Telephony activities that handle SIM PIN/PIN2 entry (ChangeIccPinScreen, EnableIccPinScreen, GetPin2Screen), FDN management (FdnSetting, FdnList, BaseFdnContactScreen, EditFdnContactScreen, DeleteFdnContactScreen), SIM contacts (ADNList, SimContacts), call feature settings (CallFeaturesSetting, GsmUmts*/Cdma* call option, forwarding and barring screens) and EmergencyDialer did not set SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS in onCreate, so overlay windows of other apps were not hidden while these screens were shown. The bulletin rates this as a High severity EoP.

How the fix works

• Single commit (Change-Id I953667309753ff6fc966956e246512de97ad8638, 92f47baf4505 in android-security-14.0.0_r19). Each patched onCreate adds getWindow().addSystemFlags(android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS). In most files it directly follows super.onCreate(). In CallFeaturesSetting it follows the DBG log line. In ADNList it follows requestFeature(Window.FEATURE_INDETERMINATE_PROGRESS). In BaseFdnContactScreen it follows resolveIntent() and requestFeature(). No other logic changes; 70 insertions, 0 deletions.
• src/com/android/phone/ADNList.java:onCreate, SimContacts.java:onCreate, settings/fdn/FdnList.java:onCreate: SIM/FDN contact list screens get the flag (SimContacts and FdnList extend ADNList and also set it in their own onCreate).
• src/com/android/phone/ChangeIccPinScreen.java:onCreate, EnableIccPinScreen.java:onCreate, settings/fdn/GetPin2Screen.java:onCreate: SIM PIN / PIN2 entry screens get the flag before setContentView.
• src/com/android/phone/settings/fdn/BaseFdnContactScreen.java:onCreate, EditFdnContactScreen.java:onCreate, DeleteFdnContactScreen.java:onCreate, FdnSetting.java:onCreate: FDN management screens get the flag (the two subclasses set it in addition to the base class).
• src/com/android/phone/CallFeaturesSetting.java:onCreate (before the admin-user check), GsmUmtsCallOptions, GsmUmtsAdditionalCallOptions, GsmUmtsCallForwardOptions, GsmUmtsCallBarringOptions, CdmaCallOptions, CdmaCallForwardOptions (all :onCreate, before addPreferencesFromResource): call settings screens get the flag.
• src/com/android/phone/EmergencyDialer.java:onCreate: emergency dialer window gets the flag before reading the entry type extra.

Completeness

• Covers 18 activity classes in packages/services/Telephony; the flag is applied unconditionally in onCreate.
• Several additions are redundant but harmless: SimContacts and FdnList inherit the flag from ADNList.onCreate, and EditFdnContactScreen/DeleteFdnContactScreen inherit it from BaseFdnContactScreen.onCreate, yet each also sets it again.
• The flag is set only on the activity's own window (getWindow()). Separate windows these activities may create (for example the AlertDialog shown via builder.show() in CallFeaturesSetting, displayPwChangeDialog in GsmUmtsCallBarringOptions, EditPinPreference dialogs in FdnSetting) are not touched by this diff.
• Only the files in the diff are changed; whether other Telephony activities outside this list lack the flag is not shown by the material.
• The flag hides non-system overlay windows only; system windows are not affected (general platform knowledge).

Behavior changes

• While any of the patched activities is visible, overlay windows belonging to non-system apps (e.g. TYPE_APPLICATION_OVERLAY from apps with SYSTEM_ALERT_WINDOW) are hidden by the window manager (general platform knowledge).
• No functional or API change to the screens themselves in the diff; no new error paths or permissions.

Per major

• Android 14: same fix: commit 92f47baf4505 in android-security-14.0.0_r19, 18-file diff; at android-security-14.0.0_r29 the patched region is present (8/8 lines).
• Android 15: same fix: commit 81cc0fd56aa9 in android-security-15.0.0_r7 adds identical flag lines; surrounding code differs in ChangeIccPinScreen and EnableIccPinScreen (UserManager DISALLOW_CONFIG_MOBILE_NETWORKS check follows the insertion), other files differ only in line offsets. Present 8/8 at android-security-15.0.0_r17.
• Android 16: not affected per the bulletin (not listed); the patched region is present (8/8 lines) at android-security-16.0.0_r8.
• Android 17: not affected per the bulletin (not listed); the patched region is present (8/8 lines) at android-security-17.0.0_r1.

Unknowns

• The exact attack scenario and which activity was the reported entry point; bug 335387175 details are not in the material.
• Whether and in which tag the Android 13 fix was applied.
• Whether other Telephony activities not in this diff also lack the flag.
• Which of the patched activities are exported.
• The API level at which Window.addSystemFlags became available, relevant for older-branch backports.

Back to April 2025 · Findings