CVE-2025-48587 AI-generated analysis

platform/packages/modules/Profiling, ProfilingService (system service side of the Profiling module)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

Adds server-side validation of the trigger type in ProfilingService.addTrigger so that triggers with an unsupported type are rejected (IllegalArgumentException) instead of being stored, and makes the persisted-trigger load path skip such triggers.

Root cause

Per the commit message, profiling triggers were only validated on the manager (client) side. ProfilingService.addTrigger(ProfilingTriggerData, boolean) inserted the trigger into mAppTriggers (a ProcessMap<SparseArray<ProfilingTriggerData>>) without checking that trigger.getTriggerType() is a supported type. As a result, a trigger that did not pass through manager-side validation, or a persisted trigger with an unsupported type, could be placed into the service's in-memory trigger store. The bulletin classifies the result as a High severity DoS. The material does not show the exact failure that an invalid stored trigger causes.

How the fix works

• service/java/com/android/os/profiling/ProfilingService.java:addTrigger(ProfilingTriggerData, boolean): after the existing early-return check, adds a check `ProfilingTrigger.isValidRequestTriggerType(trigger.getTriggerType())`. If the check fails, it logs a warning and throws IllegalArgumentException("Trigger type is not supported") before the trigger is looked up in or inserted into mAppTriggers.
• service/java/com/android/os/profiling/ProfilingService.java: the loop that fills mAppTriggers from the persisted ProfilingTriggersWrapper (addTrigger(new ProfilingTriggerData(triggerProto), false) for each entry) is wrapped in a try/catch for IllegalArgumentException. A persisted trigger with an invalid type is ignored (logged only when DEBUG), loading continues, and mAppTriggersLoaded is still set to true.
• service/java/com/android/os/profiling/ProfilingService.java: the comment on the mAppTriggers field now states that additions must only go through addTrigger(ProfilingTriggerData, boolean), which performs the validation.

Completeness

• The validation applies to every caller of addTrigger. The load-from-storage path (persist=false) now drops invalid entries. Other callers, which the diff does not show, now receive the exception.
• Only the trigger type is validated (ProfilingTrigger.isValidRequestTriggerType). This change does not validate other ProfilingTriggerData fields.
• The guarantee depends on every writer to mAppTriggers using addTrigger, as the new field comment states. The material does not show whether any other code path writes to mAppTriggers directly.
• The diff does not show the Binder entry point that leads to addTrigger, so it is not visible whether that entry point performs any additional validation.

Behavior changes

• ProfilingService.addTrigger now throws IllegalArgumentException for an unsupported trigger type instead of storing the trigger.
• Triggers persisted to storage with an unsupported type are skipped on load (a warning is logged only if DEBUG) rather than being placed into mAppTriggers.
• A new Log.w(TAG, "Attempted to add invalid profiling trigger.") is emitted on rejection.

Per major

• Android 14: not affected per the bulletin; the Profiling project is not present in android-security-14.0.0_r29.
• Android 15: not affected per the bulletin; at android-security-15.0.0_r17 only 2/8 lines of the patched region exist, which suggests most of the trigger-handling code this fix targets is absent in 15.
• Android 16: same fix: ceaaf1330d3a cherry-picked into android-security-16.0.0_r4 (Change-Id I422171ef7cb8519f5c138f1b39ae9a008a0df7ae); at android-security-16.0.0_r8, 7/8 lines of the patched region are present.
• Android 17: not affected per the bulletin; at android-security-17.0.0_r1, 7/8 lines of the patched region are present.

Unknowns

• The exact failure caused by an invalid trigger type in mAppTriggers (what causes the DoS) is not shown in the material.
• The IProfilingService Binder entry point that leads to addTrigger, and the checks it already performs, are not shown.
• Which of the 8 patched lines is missing at android-security-16.0.0_r8 and android-security-17.0.0_r1 is not shown.
• The implementation of ProfilingTrigger.isValidRequestTriggerType, the set of accepted types, and where that class lives are not shown.
• Whether the fix is also delivered through a module update is not shown.

Back to March 2026 · Findings