CVE-2025-22430 AI-generated analysis

platform/frameworks/base, TrustManagerService (services/core, com.android.server.trust) and ITrustManager AIDL / TrustManager client

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Adds ACCESS_FINE_LOCATION permission enforcement to the hidden system API ITrustManager.isInSignificantPlace(), which previously had no permission check on its binder implementation.

Root cause

The binder implementation of isInSignificantPlace() in TrustManagerService.java (the ITrustManager.Stub override) did no caller permission check before querying the significant place provider through mSignificantPlaceServiceWatcher.runOnBinder(...). The method in ITrustManager.aidl also had no @EnforcePermission annotation, unlike the sibling isTrustUsuallyManaged, which is annotated @EnforcePermission("TRUST_LISTENER"). As a result, callers able to reach the trust service binder could learn whether the device is in a significant place without holding a location permission. The bulletin classifies this as High severity information disclosure.

How the fix works

• core/java/android/app/trust/ITrustManager.aidl: adds @EnforcePermission("ACCESS_FINE_LOCATION") to isInSignificantPlace(). This makes the AIDL compiler generate a Stub.isInSignificantPlace_enforcePermission() helper (general platform knowledge).
• services/core/java/com/android/server/trust/TrustManagerService.java: imports android.annotation.EnforcePermission, annotates the Stub override isInSignificantPlace() with @EnforcePermission(Manifest.permission.ACCESS_FINE_LOCATION), and calls super.isInSignificantPlace_enforcePermission() as the first statement, before the android.security.Flags.significantPlaces() check and the provider query. The generated helper throws SecurityException when the caller lacks the permission (general platform knowledge).
• core/java/android/app/trust/TrustManager.java: adds @RequiresPermission(Manifest.permission.ACCESS_FINE_LOCATION) to the client wrapper isInSignificantPlace(). This annotation is for documentation and lint and does not enforce anything at runtime (general platform knowledge).

Completeness

• The server-side check covers the binder method isInSignificantPlace() in TrustManagerService, the only entry point to this data that the material shows. The check runs regardless of the significantPlaces() feature flag.
• This commit changes no other ITrustManager methods (isActiveUnlockRunning, isDeviceLocked and so on are untouched). The material shows no evidence that those need a check.

Behavior changes

• Binder callers of ITrustManager.isInSignificantPlace() that lack ACCESS_FINE_LOCATION now fail the permission check instead of getting a boolean. The generated helper throws SecurityException (general platform knowledge).
• The permission check runs before the android.security.Flags.significantPlaces() check, so it applies even when the flag is off.
• TrustManager.isInSignificantPlace() now carries @RequiresPermission(ACCESS_FINE_LOCATION).

Per major

• Android 14: not affected per the bulletin; 5/8 patched-region lines present at android-security-14.0.0_r29. The material does not show whether isInSignificantPlace() exists there.
• Android 15: same fix; resolved via bug_id in android-security-15.0.0_r7 as cherry-pick 161eb6100d6f (Change-Id I1c5ef857c750dbbd0577f5aadc43e9b6122de790); 8/8 patched lines present at android-security-15.0.0_r17.
• Android 16: not affected per the bulletin; 8/8 patched lines present at android-security-16.0.0_r8.
• Android 17: not affected per the bulletin; 8/8 patched lines present at android-security-17.0.0_r1.

Unknowns

• Which platform callers (for example SystemUI or keyguard) invoke TrustManager.isInSignificantPlace(), and whether they hold ACCESS_FINE_LOCATION.
• Whether a test accompanied the fix; the commit says Test: manual.
• The original commits 389e4cf737571bf0c438239400295fd229acc3e8 and f085fccf0bb7963962ae56618c5b3a1762d3aeab are referenced but not shown.
• The state of isInSignificantPlace() on Android 14 (only 5/8 patched-region lines present).
• What isInSignificantPlace() returns when the flag is off or no provider is bound; the diff is truncated.

Back to April 2025 · Findings