From 287e22a904dccf9670560973f3bbd392a7f94561 Mon Sep 17 00:00:00 2001 From: Jay Thomas Sullivan Date: Thu, 24 Jun 2021 21:32:07 -0400 Subject: [PATCH] Fix isAutoRevokeWhitelisted vulnerability Apps should not be allowed to programatically check whether a given package is installed on the current device. But, currently, isAutoRevokeWhitelisted allows app to do so by invoking isAutoRevokeWhitelisted for a package name, then checking for an error: - if NullPointerException is thrown, the package does not exist, or - if SecurityException is thrown, the package exists. The NullPointerException occurs in PermissionManagerService on the line: final int packageUid = UserHandle.getUid(userId, pkg.getUid()); ^ null The solution is to: - avoid a NullPointerException by moving the above line of code down below where we've already null-checked 'pkg' (checkAutoRevokeAccess), - return false when the target app doesn't exist, and - return false when the calling app doesn't have permission to access the target app (via filterAppAccess). Bug: 186404493 Test: manual Change-Id: Ibae43d92b8eee24a0e56f08c878a7fe793833287 --- .../server/pm/permission/PermissionManagerService.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/pm/permission/PermissionManagerService.java b/services/core/java/com/android/server/pm/permission/PermissionManagerService.java index 30eccca48ee93..08f6a27e49b52 100644 --- a/services/core/java/com/android/server/pm/permission/PermissionManagerService.java +++ b/services/core/java/com/android/server/pm/permission/PermissionManagerService.java @@ -1381,12 +1381,16 @@ public class PermissionManagerService extends IPermissionManager.Stub { final AndroidPackage pkg = mPackageManagerInt.getPackage(packageName); final int callingUid = Binder.getCallingUid(); - final int packageUid = UserHandle.getUid(userId, pkg.getUid()); + if (mPackageManagerInt.filterAppAccess(packageName, callingUid, userId)) { + return false; + } if (!checkAutoRevokeAccess(pkg, callingUid)) { return false; } + final int packageUid = UserHandle.getUid(userId, pkg.getUid()); + final long identity = Binder.clearCallingIdentity(); try { return mAppOpsManager.checkOpNoThrow(