CVE-2025-48579 AI-generated analysis
platform/packages/providers/MediaProvider, MediaProvider.java (update and getMediaUri call paths)
MediaProvider now restores the cleared calling identity before rethrowing when ContentUris.parseId throws NumberFormatException in updateInternal (and, in the 15/16 commits, before throwing IllegalArgumentException for an unsupported authority in getResultForGetMediaUri), so these exceptions no longer leave MediaProvider's own identity in effect.
Root cause
In MediaProvider#updateInternal, the code calls clearLocalCallingIdentity() and then computes genericUri with MediaStore.Files.getContentUri(volumeName, ContentUris.parseId(uri)). This call is not inside any try/finally. If the URI's ID segment is not a valid long, ContentUris.parseId throws NumberFormatException and the method exits without calling restoreLocalCallingIdentity(token), so the cleared (provider) local calling identity stays in effect. Per the commit message and the 15/16 diffs, MediaProvider#getResultForGetMediaUri had the same flaw. When the document URI authority is neither MediaDocumentsProvider.AUTHORITY nor DocumentsContract.EXTERNAL_STORAGE_PROVIDER_AUTHORITY, it throws IllegalArgumentException("Provider for this Uri is not supported.") without calling restoreCallingIdentity(token).
How the fix works
- src/com/android/providers/media/MediaProvider.java:updateInternal: the genericUri computation is wrapped in try { ... } catch (NumberFormatException e) { restoreLocalCallingIdentity(token); throw e; }. The exception still reaches the caller, but the LocalCallingIdentity token is restored first. The later try-with-resources around queryForSingleItem is unchanged.
- src/com/android/providers/media/MediaProvider.java:getResultForGetMediaUri (Android 15 and 16 commits only): restoreCallingIdentity(token) is inserted immediately before throw new IllegalArgumentException("Provider for this Uri is not supported.") in the authority check, so the calling identity is restored on that early-exit path.
Completeness
- Covers exactly the two exceptional exits named in the commit message: NumberFormatException from ContentUris.parseId in updateInternal, and the unsupported-authority IllegalArgumentException in getResultForGetMediaUri.
- The fix is targeted (catch-and-restore, or restore-before-throw). It does not wrap everything after clearLocalCallingIdentity in a try/finally, so the shown change does not cover other exception types thrown between clearLocalCallingIdentity() and the existing try block in updateInternal.
- The Android 14 commit contains only the updateInternal hunk. The getResultForGetMediaUri hunk in the 15 and 16 commits is missing from the 14 diff, even though the 14 commit message describes that bug. The material does not show the Android 14 state of getResultForGetMediaUri.
- The surrounding Android 14 code shown (handleRedactedFileLookup) has a similar clear-then-throw path that this fix does not touch (see potential_variants).
Behavior changes
- No new error codes or results: the caller still gets the same NumberFormatException or IllegalArgumentException. The only difference is that the calling identity is restored before the exception leaves the method.
Per major
- Android 14: Adapted/partial fix: commit 12fbdbc6beda in android-security-14.0.0_r25 contains only the updateInternal NumberFormatException hunk (6/6 lines present at android-security-14.0.0_r29). The getResultForGetMediaUri hunk is not in the 14 commit, although the commit message describes it.
- Android 15: Same fix, both hunks: commit 2a8f3f27275c in android-security-15.0.0_r13 adds restoreCallingIdentity(token) in getResultForGetMediaUri and the try/catch in updateInternal (8/8 lines present at android-security-15.0.0_r17).
- Android 16: Same fix, both hunks: commit 7ea0a039ec32 in android-security-16.0.0_r4. The content matches the 15 commit at different line offsets (8/8 lines present at android-security-16.0.0_r8).
- Android 17: Not affected (not listed by the bulletin). The updateInternal patched region is present at android-security-17.0.0_r1 (6/6 lines).
Unknowns
- The material does not show why the Android 14 commit omits the getResultForGetMediaUri hunk (the code or pattern may be absent on 14, or it may have been fixed separately).
- The material does not show which privileged operations become reachable with the leaked identity after the exception.
- The material does not say whether the two bug IDs (417195606, 418225717) map one-to-one onto the two hunks.