CVE-2025-32331 AI-generated analysis
platform/frameworks/base, SystemUI keyguard (KeyguardService / fold grace period)
The fix makes IKeyguardService.showDismissibleKeyguard() in SystemUI's KeyguardService return early whenever ActivityManager reports a lock task mode other than NONE (app pinning). As a result, folding a device with "Swipe up to continue" set no longer shows a dismissible keyguard over a pinned app.
Root cause
On foldables, when the "Continue using apps on fold" setting is "Swipe up to continue", folding the device shows a dismissible keyguard (per the commit message). The handler for this, KeyguardService's showDismissibleKeyguard(), forwarded after trace() and checkPermission() to mKeyguardViewMediator.showDismissibleKeyguard() and then ran a block gated on SceneContainerFlag.isEnabled() && mFoldGracePeriodProvider.get().isEnabled(), all without checking lock task state. Per index search, KeyguardViewMediator.showDismissibleKeyguard() checks only fold grace period enablement and device provisioning. The dismissible keyguard was therefore shown even with a pinned app. The fix keeps the app pinned and in the same security state as when the device was unfolded (per the commit message). The bulletin rates this as a High EoP.
How the fix works
- packages/SystemUI/src/com/android/systemui/keyguard/KeyguardService.java, constructor: adds an injected ActivityManager parameter and stores it in a new final field, mActivityManager.
- packages/SystemUI/src/com/android/systemui/keyguard/KeyguardService.java, showDismissibleKeyguard(): after trace() and checkPermission(), returns early if mActivityManager.getLockTaskModeState() != ActivityManager.LOCK_TASK_MODE_NONE. On Android 15 this skips both mKeyguardViewMediator.showDismissibleKeyguard() and the SceneContainerFlag/fold grace period block. On Android 16 it skips the mFoldGracePeriodProvider/mKeyguardInteractor.showDismissibleKeyguard() path. Result: when the device is folded with an app pinned, the screen stays on with the pinned app displayed (per the commit message).
Completeness
- The gate is applied only at the showDismissibleKeyguard() entry point in KeyguardService. Per index search, KeyguardViewMediator.showDismissibleKeyguard() still has no lock task check of its own, so the protection depends on requests going through KeyguardService. The material shows no other caller.
- The check treats every lock task state other than LOCK_TASK_MODE_NONE the same way. This would include both pinned and locked task modes (general platform knowledge).
- No regression test is added: the commit message says it was tested manually, and the diff touches only KeyguardService.java.
Behavior changes
- showDismissibleKeyguard() now returns without logging or reporting an error when lock task mode is active. When folded, the device stays on and shows the pinned app.
- Each showDismissibleKeyguard() request now calls ActivityManager.getLockTaskModeState().
- The KeyguardService constructor gains a new ActivityManager parameter. This affects Dagger injection and any code that constructs the service directly.
Per major
- Android 14: Not affected (not listed by the bulletin). At android-security-14.0.0_r29, 5/8 lines of the patched region are present.
- Android 15: Same fix: commit 7f5cc94e82fc in android-security-15.0.0_r10 (cherry-pick of 14f874decfdd). It adds ActivityManager injection and the lock task early return before mKeyguardViewMediator.showDismissibleKeyguard(). At android-security-15.0.0_r17, 7/8 lines of the region are present.
- Android 16: Adapted fix: commit 705d322dc8b6 in android-security-16.0.0_r1. Same ActivityManager injection and early return, placed before the mFoldGracePeriodProvider/mKeyguardInteractor.showDismissibleKeyguard() body, which differs from 15. At android-security-16.0.0_r8, 8/8 lines are present.
- Android 17: Not affected (not listed by the bulletin). At android-security-17.0.0_r1, 6/8 lines of the patched region are present.
Unknowns
- Which system component invokes IKeyguardService.showDismissibleKeyguard() on fold.
- What checkPermission() enforces.
- How a dismissible keyguard over a pinned app leads to the EoP the bulletin describes. The commit message only says the fix keeps the app pinned and in the same security state.
- Whether a dismissible keyguard that is already showing when lock task mode starts is handled elsewhere.
- Whether Android 14 contains the fold grace period / showDismissibleKeyguard code at all, and what form the code takes on Android 17.