CVE-2026-28584 AI-generated analysis
platform/frameworks/base, PackageManager / PackageInstallerService (install session parameters)
PackageInstallerService now deduplicates SessionParams.whitelistedRestrictedPermissions (rebuilding the list from a HashSet) before intersecting it with the platform restricted permission set, so the list can no longer be made arbitrarily long with repeated valid entries.
Root cause
In services/core/java/com/android/server/pm/PackageInstallerService.java, the only check on params.whitelistedRestrictedPermissions was retainAll(mPm.getAllPlatformRestrictedPermissions()). retainAll removes unknown permission names but keeps every duplicate of a valid name, so the caller controlled the length of the list. The field is a hidden API, but the commit message says it can be set directly through reflection. A caller could therefore supply a very large list of repeated valid restricted permission names that passed this check. The regression test is named SessionSizeLimitTest, which suggests the impact is growth in session size; the bulletin rates it DoS.
How the fix works
- services/core/java/com/android/server/pm/PackageInstallerService.java, inside the `if (params.whitelistedRestrictedPermissions != null)` block (around line 1081): before the existing retainAll, the list is replaced with `new ArrayList<>(new HashSet<>(params.whitelistedRestrictedPermissions))`, which removes all duplicates.
- The existing `retainAll(mPm.getAllPlatformRestrictedPermissions())` is kept and now runs on the deduplicated list, so the result can be no longer than the number of distinct platform restricted permissions.
- Adds `import java.util.HashSet;`. Single-commit fix, 3 lines added.
Completeness
- Covers only SessionParams.whitelistedRestrictedPermissions in this validation block of PackageInstallerService.java. After the fix the list can be no longer than the number of distinct platform restricted permissions.
- The dedup replaces the list object (new ArrayList) instead of changing it in place. Entry order is not preserved (HashSet iteration order).
- The fix adds no explicit size limit; the bound comes from retainAll against the platform set. This commit does not touch the other list or collection fields of SessionParams, and the material does not show whether they have comparable validation.
Behavior changes
- Duplicate entries in whitelistedRestrictedPermissions are silently collapsed; no error is returned.
- After validation, the entries in params.whitelistedRestrictedPermissions are no longer in the caller's order.
- params.whitelistedRestrictedPermissions is replaced with a new ArrayList instance rather than mutated in place.
Per major
- Android 14: not affected per the bulletin (not listed). At android-security-14.0.0_r29, 6/8 lines of the patched region are present, consistent with the block existing without the dedup lines.
- Android 15: not affected per the bulletin (not listed). At android-security-15.0.0_r17, 6/8 lines of the patched region are present, consistent with the block existing without the dedup lines.
- Android 16: not affected per the bulletin (not listed). At android-security-16.0.0_r8, 6/8 lines of the patched region are present, consistent with the block existing without the dedup lines.
- Android 17: same fix: 89e9c4b37577 in android-security-17.0.0_r1 (cherry-pick of 174693f1586b), 8/8 lines present.
Unknowns
- The material does not show the downstream consumer where the oversized list causes the DoS (persisted session XML, memory, or IPC). Only the test name SessionSizeLimitTest hints at session size.
- The enclosing method name is not visible in the provided context.
- The material does not explain why 14/15/16 are treated as not affected when they contain the same unpatched block. It also does not explain why the bulletin's affected list includes 16-qpr2 while Android 16 is not listed.