CVE-2025-48578 AI-generated analysis

platform/packages/providers/MediaProvider, MediaProvider.java (content provider update path and getMediaUri call path)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Makes MediaProvider restore the caller identity it had cleared before an exception propagates: in MediaProvider#updateInternal when ContentUris.parseId throws NumberFormatException, and (on 15/16) in MediaProvider#getResultForGetMediaUri when an unsupported document authority causes an IllegalArgumentException.

Root cause

In MediaProvider#updateInternal the code calls clearLocalCallingIdentity() and then evaluates MediaStore.Files.getContentUri(volumeName, ContentUris.parseId(uri)) outside of any try/finally. If the URI's id segment is not numeric, ContentUris.parseId throws NumberFormatException and the exception escapes. The cleared identity token is never passed back to restoreLocalCallingIdentity. The commit message describes the same defect in MediaProvider#getResultForGetMediaUri: after the calling identity is cleared, an IllegalArgumentException is thrown for an unsupported documentUri authority without calling restoreCallingIdentity(token) first.

How the fix works

• src/com/android/providers/media/MediaProvider.java:updateInternal: the genericUri computation is wrapped in try/catch (NumberFormatException e). On catch, restoreLocalCallingIdentity(token) is called and the exception is rethrown unchanged. The existing try-with-resources around queryForSingleItem is untouched.
• src/com/android/providers/media/MediaProvider.java:getResultForGetMediaUri (in the Android 15 and 16 commits only): restoreCallingIdentity(token) is inserted immediately before throw new IllegalArgumentException("Provider for this Uri is not supported.") in the authority check against MediaDocumentsProvider.AUTHORITY and DocumentsContract.EXTERNAL_STORAGE_PROVIDER_AUTHORITY.
• The Android 14 commit 12fbdbc6beda is a cherry-pick (its message lists a chain of upstream cherry-picks under one Change-Id). Although its message describes both methods, its diff contains only the updateInternal hunk (1 file, 9 insertions, 2 deletions).

Completeness

• The updateInternal change covers only NumberFormatException from ContentUris.parseId. Any other unchecked exception thrown between clearLocalCallingIdentity() and the try-with-resources block would still leave the identity unrestored, but the diff shows no other statement in that gap.
• The getResultForGetMediaUri change covers only the unsupported-authority throw. It restores the identity just before that one throw, rather than wrapping the whole cleared region in a try/finally.
• On Android 14 the fix commit contains only the updateInternal hunk. The getResultForGetMediaUri hunk mentioned in the commit message is absent from the 14 diff, and the material does not show whether that code exists on 14.
• The code context at android-security-14.0.0_r29 shows handleRedactedFileLookup clearing the identity at line 2223. It then throws IllegalStateException on VolumeNotFoundException (lines 2227-2231), before the try/finally that restores the identity. The fix does not touch this path (see potential_variants).

Behavior changes

• Returned results and exception types do not change: NumberFormatException and IllegalArgumentException still reach the caller as before. The only difference is that the calling identity is restored first.
• No new validation, error codes or logging are added.

Per major

• Android 14: adapted fix: commit 12fbdbc6beda in android-security-14.0.0_r25 carries only the updateInternal NumberFormatException hunk; the getResultForGetMediaUri hunk is not in the 14 diff. 6/6 lines of the patched region are present at android-security-14.0.0_r29.
• Android 15: same fix with both hunks: commit 2a8f3f27275c in android-security-15.0.0_r13 (restoreCallingIdentity before the IllegalArgumentException in getResultForGetMediaUri, plus the updateInternal try/catch). 8/8 lines present at android-security-15.0.0_r17.
• Android 16: same fix with both hunks: commit 7ea0a039ec32 in android-security-16.0.0_r4, identical content to the 15 change at different line offsets. 8/8 lines present at android-security-16.0.0_r8.
• Android 17: not affected: the bulletin does not list Android 17. 6/6 lines of the patched region are present at android-security-17.0.0_r1.

Unknowns

• Why the Android 14 commit omits the getResultForGetMediaUri hunk: either the matching code or clearCallingIdentity call is absent on 14, or the hunk was dropped.
• The material does not show what the unrestored identity does to later requests (how the thread-local identity is reused). The bulletin only classifies the issue as High EoP.
• Which conditions earlier in updateInternal lead to the patched block (the surrounding function body is not in the material).
• Why the Android 17 tag reports 6/6 rather than 8/8 lines (getResultForGetMediaUri may have been refactored); not shown.

Back to March 2026 · Findings