CVE-2023-40130 AI-generated analysis

platform/packages/services/Telecomm, call redirection (src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Adds an onBindingDied override to Telecom's CallRedirectionServiceConnection that calls finishCallRedirection() under mTelecomLock, so the CallRedirectionService is unbound when its binding dies.

Root cause

CallRedirectionProcessor.CallRedirectionServiceConnection implemented onServiceConnected, onServiceDisconnected and onNullBinding (the last two call finishCallRedirection()), but did not override onBindingDied. When the CallRedirectionService binding died, Telecom did nothing. Per the commit message, an app implementing CallRedirectionService could, in onPlaceCall, schedule an activity start from a separate process and then kill itself, and the activity could still start after the service died. The bulletin rates this as High severity EoP.

How the fix works

• CallRedirectionProcessor.java:CallRedirectionServiceConnection.onBindingDied (new override, Android 14 commits 18299e2d9062 and 2536d3735135): starts log session "CRSC.oBD" and, under synchronized (mTelecomLock), calls finishCallRedirection(). This mirrors the existing onServiceDisconnected and onNullBinding handlers. Per the commit message, this unbinds the service when the binding dies. The body of finishCallRedirection() is not shown.
• CallRedirectionProcessor.java:notifyTimeout (Android 15 commit 3623312367a5 and Android 16 commit a43a880beaa6, "Catch IllegalArgumentException when unbinding CallRedirectionServiceConnection"): wraps mContext.unbindService(mConnection) in a try/catch for IllegalArgumentException and logs the error. The same try/catch appears in the Android 14 code at android-security-14.0.0_r29 (lines 139-144). The material does not show how this commit relates to the onBindingDied change.

Completeness

• Three ServiceConnection callbacks in CallRedirectionServiceConnection now call finishCallRedirection(): onServiceDisconnected, onNullBinding and onBindingDied. Separately, notifyTimeout unbinds on timeout.
• The material does not show whether finishCallRedirection() has the same IllegalArgumentException protection that the 15/16 commits add to notifyTimeout.
• Only CallRedirectionProcessor is changed. The material does not show whether other Telecom ServiceConnection implementations handle onBindingDied.

Behavior changes

• When a bound CallRedirectionService's binding dies, Telecom now calls finishCallRedirection(), which per the commit message unbinds the service.
• A new Telecom log session tag "CRSC.oBD" is emitted when the binding dies.
• On Android 15 and 16 (and in the 14 r29 code), an IllegalArgumentException thrown by unbindService in notifyTimeout is caught and logged instead of propagating.

Per major

• Android 14: Same fix: onBindingDied override added in android-security-14.0.0_r1 (commit 18299e2d9062; identical commit 2536d3735135 in r2; Change-Id I065d361b83700474a1efab2a75928427ee0a14ba). At android-security-14.0.0_r29 the patched region is present (2/2 lines), and notifyTimeout also has the try/catch for IllegalArgumentException around unbindService.
• Android 15: Resolved by change_id in android-security-15.0.0_r12. The linked commit 3623312367a5 only wraps unbindService in notifyTimeout with a try/catch for IllegalArgumentException. The patched region is reported present at android-security-15.0.0_r17 (7/7 lines). The material does not show which commit introduced onBindingDied on 15.
• Android 16: Resolved by change_id in android-security-16.0.0_r3 via commit a43a880beaa6, which has the same notifyTimeout try/catch diff as 15. The patched region is present at android-security-16.0.0_r8 (7/7 lines). The commit that introduced onBindingDied on 16 is not shown.
• Android 17: Not listed by the bulletin. The patched region is present (2/2 lines) at android-security-17.0.0_r1.

Unknowns

• The body of finishCallRedirection() is not shown. The material only shows the unbind sequence in notifyTimeout.
• Why the Android 15/16 resolver matched the IllegalArgumentException-catch commits (3623312367a5, a43a880beaa6) by Change-Id, whether they are needed for this fix, and which commit introduced onBindingDied on those branches.
• The platform mechanism by which the binding that was not released allowed the activity start. The commit message describes only the outcome.

Back to December 2025 · Findings