CVE-2025-26432 AI-generated analysis

platform/frameworks/base, CompanionDeviceManager system service (services/companion)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

Adds a 1024-character upper bound on the tag string accepted by CompanionDeviceManagerService's setAssociationTag binder method, rejecting longer tags with IllegalArgumentException before they reach AssociationRequestsProcessor.

Root cause

The overridden setAssociationTag(int associationId, String tag) method inside CompanionDeviceManagerService forwarded the caller-supplied tag string to mAssociationRequestsProcessor.setAssociationTag without any limit on its length, so an arbitrarily large tag could be passed on to the processor. The bulletin classifies the impact as DoS.

How the fix works

• services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java : setAssociationTag (stub method inside CompanionDeviceManagerService): before delegating to mAssociationRequestsProcessor.setAssociationTag, the fix checks tag.length() > 1024 and throws IllegalArgumentException("Length of the tag must be at most1024 characters"), so oversized tags are rejected at the service boundary.
• No other files or functions are changed. The processor and the association storage are untouched.

Completeness

• Only the setAssociationTag entry point in CompanionDeviceManagerService is guarded. The fix does not change AssociationRequestsProcessor.setAssociationTag itself, so any other internal path reaching it (none shown in the material) is not covered.
• The new check calls tag.length() without a null check. In the same file, clearAssociationTag(int associationId) calls setAssociationTag(associationId, null), so per the code shown at android-security-15.0.0_r17 that path would now hit a NullPointerException on tag.length() before reaching the processor. The material does not show whether a null can also arrive over binder.
• The limit is on Java String length (UTF-16 code units), not on serialized byte size.

Behavior changes

• setAssociationTag now throws IllegalArgumentException for tags longer than 1024 characters (previously accepted).
• clearAssociationTag, which passes null into setAssociationTag, now dereferences null in the new check as written in the diff, so it would throw instead of reaching the processor.

Per major

• Android 14: not affected per the bulletin; at android-security-14.0.0_r29 the patched region is absent (0/2 lines).
• Android 15: same fix: commit a928f3273592 in android-security-15.0.0_r9 (cherry-pick of 1bea5725035b, Change-Id I7adae8cd57b26e0e9a27d68c49c2de68fd952afd); 2/2 lines present at android-security-15.0.0_r17.
• Android 16: listed as affected (16-next) but code absent: no linked commit and 0/2 lines of the patched region at android-security-16.0.0_r8. The material does not show how Google addressed it in 16.
• Android 17: not affected per the bulletin; 0/2 lines of the patched region at android-security-17.0.0_r1.

Unknowns

• What concrete resource exhaustion or failure an oversized tag caused downstream (the storage/persistence code in AssociationRequestsProcessor is not shown).
• Why 1024 was chosen, and whether the AIDL declares the tag parameter @nullable (relevant to the clearAssociationTag null path).
• How Android 16 is fixed, since the bulletin lists 16-next but no commit or patched region is present in the material, and whether setAssociationTag exists in a different form or location on 16/17.
• Whether any permission or ownership enforcement applies to setAssociationTag.

Back to June 2025 · Findings