CVE-2025-26422 AI-generated analysis

platform/frameworks/base, WindowManagerService (services/core/java/com/android/server/wm)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (11 corrections). Verify against the commit before relying on it.

Moves the DumpUtils.checkDumpPermission check in WindowManagerService from the private doDump helper into the Binder-exposed dump() entry point, before PriorityDump.dump is called, so that the --high-priority dump (named in the commit title) is permission-gated.

Root cause

WindowManagerService.dump(FileDescriptor, PrintWriter, String[]) passed control straight to PriorityDump.dump(mPriorityDumper, fd, pw, args) without checking the caller. The DumpUtils.checkDumpPermission(mContext, TAG, pw) check was only inside the private doDump(...) helper. According to the commit title ('Check dump permissions before dumping --high-priority'), the high-priority dump was produced without first passing that check. The material does not include the mPriorityDumper implementation, so the exact unchecked route is inferred from the commit title.

How the fix works

• services/core/java/com/android/server/wm/WindowManagerService.java:dump(FileDescriptor, PrintWriter, String[]) now calls DumpUtils.checkDumpPermission(mContext, TAG, pw) first and returns early if it fails, before PriorityDump.dump(mPriorityDumper, fd, pw, args) is called.
• services/core/java/com/android/server/wm/WindowManagerService.java:doDump(...) no longer contains the checkDumpPermission call. Net change: 1 insertion, 1 deletion.

Completeness

• Covers every path that enters through WindowManagerService.dump(), whatever the arguments, because the check runs before PriorityDump.dump.
• doDump no longer has its own check. This is safe only if every caller of doDump goes through dump(). The material does not show the callers of doDump.
• The fix does not change PriorityDump or any other service. It is local to WindowManagerService.

Behavior changes

• Callers that fail DumpUtils.checkDumpPermission now get no window manager dump output on any path. According to the commit title, the high-priority dump was the path that was previously reachable without the check.
• For callers that pass the check, the dump is unchanged. The check just runs earlier.

Per major

• Android 14: Not affected (not listed by the bulletin). The patched region (6/6 lines) is present at android-security-14.0.0_r29.
• Android 15: Same fix: commit 63ae78949939 in android-security-15.0.0_r8 (cherry-picked from internal commit c617d697cdbe, Change-Id Ie4b4e0001430924674b08eabf28c656a46527727). The patched region is fully present at android-security-15.0.0_r17.
• Android 16: Not affected (not listed by the bulletin). The patched region (6/6 lines) is present at android-security-16.0.0_r8.
• Android 17: Not affected (not listed by the bulletin). The patched region (6/6 lines) is present at android-security-17.0.0_r1.

Unknowns

• The mPriorityDumper implementation and how PriorityDump routes arguments are not in the material, so the dumper method that skipped doDump's check is inferred only from the commit title.
• Whether Android 14, 16 or 17 ever had the vulnerable code is not shown. The material only shows that the patched region is present in their latest tags.
• The text DumpUtils.checkDumpPermission writes to pw when the check fails is not shown.
• Whether CarPackageManagerService and other in-tree callers of the window manager's dump hold the dump permission is not shown.
• The CTS test mentioned in the commit message is not included.

Back to May 2025 · Findings