CVE-2025-26463 AI-generated analysis

platform/frameworks/base, BlobStore (apex/blobstore framework and service)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Adds hard upper bounds (223 chars for packageName, 32 bytes for certificate) to BlobStoreManager.Session.allowPackageAccess on the client side and to BlobStoreSession.allowPackageAccess in system_server, rejecting oversized inputs with IllegalArgumentException.

Root cause

BlobStoreSession.allowPackageAccess (service side) only verified that the caller owned the session and that packageName was non-null. It accepted a packageName of any length and a certificate byte[] of any length, and did not null-check the certificate. The framework wrapper BlobStoreManager.Session.allowPackageAccess forwarded the arguments without any validation. A session owner could therefore get arbitrarily large package name / certificate values accepted by the system_server session. The bulletin rates the impact as High-severity DoS; the material does not show which downstream consumer fails.

How the fix works

• apex/blobstore/framework/java/android/app/blob/BlobStoreManager.java: adds two @hide constants, MAX_PACKAGE_NAME_LENGTH = 223 (stated to mirror android.content.pm.parsing.FrameworkParsingPackageUtils#MAX_FILE_NAME_SIZE) and MAX_CERTIFICATE_LENGTH = 32.
• BlobStoreManager.java:Session.allowPackageAccess: before calling mSession.allowPackageAccess, requires packageName and certificate to be non-null (Objects.requireNonNull) and enforces packageName.length() <= 223 and certificate.length <= 32 via Preconditions.checkArgument.
• apex/blobstore/service/java/com/android/server/blob/BlobStoreSession.java:allowPackageAccess: after assertCallerIsOwner() and the existing packageName null check, adds the same two Preconditions.checkArgument length checks plus Objects.requireNonNull(certificate), before taking mSessionLock and the STATE_OPENED check. This server-side check is the authoritative one; the client-side check only gives an early failure.
• Single commit, two files; the service imports the constants statically from the framework class.

Completeness

• Covers both the public framework wrapper and the binder-facing service method, so a direct IBlobStoreSession call that bypasses the client wrapper is also rejected.
• Validation runs before mSessionLock is taken and before the STATE_OPENED check, so no partial update occurs.
• Only the allowPackageAccess path (package name and certificate) is bounded by this commit; other caller-supplied strings/arrays in the blobstore API (for example BlobHandle fields) are not touched by this diff and their limits are not shown in the material.
• The certificate limit of 32 bytes is a fixed value; the diff does not show how previously stored oversize entries (if any were persisted) are handled on load.

Behavior changes

• BlobStoreManager.Session.allowPackageAccess now throws IllegalArgumentException for packageName longer than 223 chars or certificate longer than 32 bytes, and NullPointerException for null arguments, before any IPC.
• BlobStoreSession.allowPackageAccess (system_server) throws IllegalArgumentException for the same oversize cases and now also NullPointerException for a null certificate (previously only packageName was null-checked).
• Any caller passing a certificate longer than 32 bytes is now rejected.

Per major

• Android 14: same fix: commit 4b630be2e2b3 (cherry-picked) in android-security-14.0.0_r21; BlobStoreSession.java base differs slightly (hunk at line 327 vs 328 on 15/16); 8/8 patched lines present at android-security-14.0.0_r29.
• Android 15: same fix: commit 89c67cf1d19e in android-security-15.0.0_r9, identical content; 8/8 lines present at android-security-15.0.0_r17.
• Android 16: same fix: commit aaa1cb20b89f in android-16.0.0_r2; 8/8 lines present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); patched region fully present at android-security-17.0.0_r1.

Unknowns

• The concrete failure mode of the DoS (which component fails on the oversize package name / certificate, e.g. XML persistence or memory in system_server) is not shown in the material.
• Whether other BlobStore inputs already had length limits before this fix is not shown.
• Handling of any pre-existing persisted oversize access-mode entries after upgrade is not shown.
• Which apps can create a BlobStore session, and whether any permission is required, is not shown.

Back to June 2025 · Findings