CVE-2025-48534 AI-generated analysis

platform/packages/modules/CellBroadcastService, CellBroadcastHandler (default CBR package resolution)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

CellBroadcastHandler.getDefaultCBRPackageName now queries broadcast receivers with PackageManager.MATCH_SYSTEM_ONLY instead of flags 0, so non-system packages can no longer be selected as the default CellBroadcastReceiver package.

Root cause

getDefaultCBRPackageName in src/com/android/cellbroadcastservice/CellBroadcastHandler.java called packageManager.queryBroadcastReceivers(intent, 0). That call did not restrict results to system packages. The only filter after it, isAppInCBApexOrAlternativeApp, is a string heuristic on ApplicationInfo.sourceDir (startsWith(CB_APEX_PATH) or contains(CB_APP_PLATFORM_NAME)) and does not require a system package. A non-system app whose receiver matched the intent and whose sourceDir passed the heuristic could therefore be a candidate for the default CBR package. The commit's test step installs a 'fake cellbroadcast app'. The bulletin classifies the issue as DoS.

How the fix works

• src/com/android/cellbroadcastservice/CellBroadcastHandler.java:getDefaultCBRPackageName: the flags argument of the queryBroadcastReceivers call changes from 0 to PackageManager.MATCH_SYSTEM_ONLY. Only receivers in system packages are now candidates. The existing sourceDir filter (isAppInCBApexOrAlternativeApp) and the empty/multiple-result handling still run after the query.
• src/com/android/cellbroadcastservice/CellBroadcastHandler.java:getDefaultCBRPackageName: visibility changes from package-private static to public static with @VisibleForTesting, so the new unit test can call it.
• tests/src/com/android/cellbroadcastservice/tests/CellBroadcastHandlerTest.java: adds testGetDefaultCBRPackageName, which calls the method with an ACTION_SMS_EMERGENCY_CB_RECEIVED intent and verifies that queryBroadcastReceivers is called once with PackageManager.MATCH_SYSTEM_ONLY. Also adds the android.content.pm.PackageManager import.

Completeness

• Covers the single queryBroadcastReceivers call in getDefaultCBRPackageName. Any package not flagged as system is excluded, whatever its sourceDir.
• The sourceDir string heuristic in isAppInCBApexOrAlternativeApp (startsWith(CB_APEX_PATH) || contains(CB_APP_PLATFORM_NAME)) is unchanged. The fix relies on MATCH_SYSTEM_ONLY instead of tightening that check.
• This commit does not touch the implicit broadcast path visible in the context (CellBroadcastIntents.sendSmsCbReceivedBroadcast to UserHandle.ALL, commented as reaching 'various 3rd party carrier apps'). The material does not show whether that path depends on getDefaultCBRPackageName.
• The material does not show other queryBroadcastReceivers callers or other package-resolution helpers in the module, so coverage beyond this function cannot be judged.

Behavior changes

• Non-system packages are never returned as the default CBR package, even if their sourceDir matches the heuristic. If no system package passes the filters, the method logs ERRTYPE_NOTFOUND_DEFAULTCBRPKGS and returns null.
• getDefaultCBRPackageName becomes public (annotated @VisibleForTesting). No functional change for callers inside the module.
• New unit test testGetDefaultCBRPackageName in CellBroadcastHandlerTest.

Per major

• Android 14: same fix: commit af24a165e952 in android-security-14.0.0_r22 (RESTRICT AUTOMERGE, cherry-picked from f24f40e2512f). At android-security-14.0.0_r29, 7/8 lines of the patched region are present, and the shown code contains the MATCH_SYSTEM_ONLY call.
• Android 15: same fix: commit 584cec4f17ea in android-security-15.0.0_r10. The source hunk is identical; the test hunk differs only in surrounding imports and line offsets. At android-security-15.0.0_r17, 7/8 lines of the patched region are present.
• Android 16: not affected (the bulletin does not list it). At android-security-16.0.0_r8, 7/8 lines of the patched region are present.
• Android 17: not affected (the bulletin does not list it). At android-security-17.0.0_r1, 7/8 lines of the patched region are present.

Unknowns

• The values of CB_APEX_PATH and CB_APP_PLATFORM_NAME, and so exactly how a non-system app's sourceDir satisfied the heuristic, are not shown.
• Which line of the 8-line patched region differs at the latest security tags (7/8 present) is not shown.
• The callers of getDefaultCBRPackageName inside CellBroadcastService, and whether the implicit sendSmsCbReceivedBroadcast path depends on it, are not shown.
• The concrete effect on alert delivery when a non-system package was selected is not shown beyond the bulletin's DoS classification.
• Whether the fix is also delivered through a mainline module update is not shown.
• Whether Android 13 received an equivalent commit is not shown (the bulletin lists 13 as affected, but the material has no 13 commit).

Back to September 2025 · Findings