CVE-2025-22432 AI-generated analysis

platform/packages/services/Telecomm, call redirection (com.android.server.telecom.callredirection.CallRedirectionProcessor)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Makes CallRedirectionProcessor.notifyTimeout() unbind the CallRedirectionServiceConnection and clear mConnection/mService when a call redirection service times out, so Telecom releases the bound service instead of keeping it bound.

Root cause

In CallRedirectionProcessor, the normal completion path finishCallRedirection() calls mContext.unbindService(mConnection) and clears mConnection and mService. The timeout path notifyTimeout() only passed the timeout to the remote service via mService.notifyTimeout() and then returned. It never unbound the ServiceConnection. So a call redirection service that did not respond within the redirection timeout stayed bound to Telecom after the timeout. The bulletin rates this as a High EoP.

How the fix works

• Commit 284cf771ae8f (android-security-14.0.0_r19): in src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java:notifyTimeout(), after the mService.notifyTimeout() attempt, the fix adds a log line and a cleanup step: if mConnection != null, it calls mContext.unbindService(mConnection) and sets mConnection = null; then it sets mService = null. This matches the cleanup that finishCallRedirection() already does.
• Same commit: tests/src/com/android/server/telecom/tests/CallRedirectionProcessorTest.java adds verify(mContext, times(1)).unbindService(any(ServiceConnection.class)) at four verification points in the timeout tests, so the tests check that the timeout path unbinds exactly once.
• Follow-up commit a43a880beaa6 (android-security-16.0.0_r3, 'Catch IllegalArgumentException when unbinding CallRedirectionServiceConnection'): wraps the new mContext.unbindService(mConnection) call in notifyTimeout() in try/catch (IllegalArgumentException), logs 'Error unbinding the connection', and still sets mConnection = null. The Android 14 code at android-security-14.0.0_r29 also contains this try/catch.

Completeness

• The fix covers the timeout path: notifyTimeout() now unbinds and clears state. finishCallRedirection() already unbound on normal completion, so both paths now release the connection.
• The unbind in notifyTimeout() does not check mIsCarrierRedirectionPending or mIsUserDefinedRedirectionPending the way finishCallRedirection() does. If mConnection was already cleared, the null check on mConnection prevents a second unbind.
• The first commit called unbindService() without a guard, so an IllegalArgumentException from it was not caught inside notifyTimeout(). The follow-up commit adds the try/catch.
• Other lifecycle paths of CallRedirectionServiceConnection (onServiceDisconnected, binding died, bind failure) are not shown in the material and are not changed by this fix.

Behavior changes

• On call redirection timeout, Telecom now calls Context.unbindService() on the redirection service connection and sets mConnection and mService to null.
• A new Log.i line 'notifyTimeout: call redirection has timed out so unbinding the connection' is written on timeout.
• With the follow-up commit, an IllegalArgumentException from unbindService() is caught and logged instead of propagating.

Per major

• Android 14: Same fix: 284cf771ae8f in android-security-14.0.0_r19 (unbind in notifyTimeout plus tests). The code at android-security-14.0.0_r29 also contains the try/catch (IllegalArgumentException) follow-up; 8/8 patched lines present.
• Android 15: Same fix: 1b081682e2ad in android-security-15.0.0_r7, with an identical source diff. 8/8 patched lines present at android-security-15.0.0_r17. The material does not show whether the IllegalArgumentException follow-up is present.
• Android 16: Base fix already in the branch (the diff base index 15b8aa942 is the post-fix file). The change resolved via change_id in android-security-16.0.0_r3 is a43a880beaa6, the follow-up that wraps unbindService in try/catch (IllegalArgumentException). 7/7 lines present at android-security-16.0.0_r8.
• Android 17: Not affected: the bulletin does not list Android 17. The patched region (8/8 lines) is present at android-security-17.0.0_r1.

Unknowns

• The material does not show the concrete EoP consequence of leaving the redirection service bound; the bulletin only gives High / EoP.
• Whether the IllegalArgumentException follow-up was applied on Android 15 is not shown.
• How other connection lifecycle callbacks (onServiceDisconnected, onBindingDied) are handled in CallRedirectionServiceConnection is not shown.
• The caller of notifyTimeout() and how it would handle an exception thrown by notifyTimeout() are not shown.

Back to December 2025 · Findings