CVE-2025-48575 AI-generated analysis

platform/packages/apps/CertInstaller, CertInstaller activity (CA certificate installation flow)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

CertInstaller now trusts a "called by Settings" referrer for the CA certificate installation path only if the package named com.android.settings resolves to the system uid. Before, it relied on the referrer package-name string alone.

Root cause

CredentialHelper.calledBySettings() returned true whenever mReferrer was string-equal to "com.android.settings". CertInstaller used this in two places to choose the privileged InstallOthersAction / installCertificateOrShowNameDialog() path. Nothing checked that the package with that name was really the system Settings app. Per the commit comment, some systems have no preinstalled com.android.settings, so an impostor package could take that name, be treated as Settings, and install CA certificates through CertInstaller.

How the fix works

• src/com/android/certinstaller/CertInstaller.java: adds a private isCalledBySettings(). It first requires SETTINGS_PACKAGE.equals(mCredentials.getReferrer()). It then reads getPackageManager().getApplicationInfo("com.android.settings", 0).uid and returns UserHandle.isSameApp(settingsUid, Process.SYSTEM_UID). If the package is not found (NameNotFoundException), it logs an error and returns false.
• src/com/android/certinstaller/CertInstaller.java: the two call sites that used mCredentials.calledBySettings() now call isCalledBySettings(). These are the branch that runs new InstallOthersAction().run(this), and the success branch (after removeDialog(PROGRESS_BAR_DIALOG) / removeDialog(PKCS12_PASSWORD_DIALOG)) that calls installCertificateOrShowNameDialog() when validCertificateSelected() is true.
• src/com/android/certinstaller/CredentialHelper.java: removes the SETTINGS_PACKAGE constant and the calledBySettings() method, so the name-only check no longer exists.

Completeness

• Both uses of the Settings-trust decision in CertInstaller.java are converted, and the old name-only helper is deleted from CredentialHelper.java.
• The new check verifies the uid of whatever package is installed under the name com.android.settings (it must share the system app id). It does not verify the uid of the actual calling process. It closes the case the commit comment describes: no system Settings is installed and an impostor holds that package name. The material does not show whether a caller can set the referrer string (mCredentials.getReferrer()) independently of its real package identity, so that case cannot be judged from the code provided.
• If com.android.settings is absent, the privileged path is now unreachable (the check returns false) instead of being decided by name alone.

Behavior changes

• On devices where no package named com.android.settings exists, or where it does not have the system uid, CertInstaller no longer takes the Settings-only install path. It falls to the non-Settings branch instead.
• A new error log "Unable to find info for settings package" is written when the Settings package cannot be resolved.
• Each decision now does one extra PackageManager.getApplicationInfo lookup.

Per major

• Android 14: same fix: 17c124efb1f1 in android-security-14.0.0_r24 (cherry-pick, Change-Id I3779b0d38dafee2333716113f6d5f4de78529380); 8/8 patched lines present at android-security-14.0.0_r29.
• Android 15: same fix: b24bef75f325 in android-security-15.0.0_r12. The CertInstaller.java hunks are identical to Android 14 (570c400..883c897), while the CredentialHelper.java base blob differs (bc1a141); 8/8 lines present at android-security-15.0.0_r17.
• Android 16: same fix: d688ebdbfd40 in android-security-16.0.0_r3, with hunks identical to Android 15; 8/8 lines present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); the patched region (8/8 lines) is present at android-security-17.0.0_r1.

Unknowns

• How CredentialHelper.mReferrer is populated (for example from the launching intent or from the activity's referrer) is not shown in the material.
• What the non-Settings fallback branch does when isCalledBySettings() is false is not shown.
• Whether Android 13 (listed as affected by the bulletin) received the same change is not covered by the per-major facts.
• Whether a clean apply works on trees other than the listed security tags is not shown.

Back to December 2025 · Findings