From 0594d55d3295ab78fcba890b77c63431124ca51e Mon Sep 17 00:00:00 2001 From: Jackal Guo Date: Thu, 3 Nov 2022 14:38:48 +0800 Subject: [PATCH] Fix side channel information disclosure This method reacts differently when the given package name isn't installed, and is installed but not belonging to the caller. This subtle difference leaves the possibility that malicious code could do a side channel attack. Bug: 249058614 Test: atest CtsWindowManagerDeviceTestCases:ToastWindowTest Test: atest CtsWindowManagerDeviceTestCases:WindowContextPolicyTests Test: atest CtsWindowManagerDeviceTestCases:WindowUntrustedTouchTest Test: atest CtsToastLegacyTestCases:ToastTest Test: atest CtsToastTestCases:LegacyToastTest Test: atest FrameworksCoreTests:ViewRootImplTest Test: atest FrameworksUiServicesTests:NotificationManagerServiceTest Change-Id: I37f28b6a660c4a3d2cd92b25d3f68066902c692f Change-Id: I52372bec19355ea8855ead28fcb0ab250c527f19 --- .../server/wm/WindowManagerService.java | 20 ++++++------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java index edb80d73e95f6..99a0e9032addf 100644 --- a/services/core/java/com/android/server/wm/WindowManagerService.java +++ b/services/core/java/com/android/server/wm/WindowManagerService.java @@ -1928,22 +1928,14 @@ public class WindowManagerService extends IWindowManager.Stub && attachedWindow.mActivityRecord.mTargetSdk >= Build.VERSION_CODES.O; } else { // Otherwise, look at the package - try { - ApplicationInfo appInfo = mContext.getPackageManager() - .getApplicationInfoAsUser(packageName, 0, - UserHandle.getUserId(callingUid)); - if (appInfo.uid != callingUid) { - throw new SecurityException("Package " + packageName + " not in UID " - + callingUid); - } - if (appInfo.targetSdkVersion >= Build.VERSION_CODES.O) { - return true; - } - } catch (PackageManager.NameNotFoundException e) { - /* ignore */ + final ApplicationInfo appInfo = mPmInternal.getApplicationInfo( + packageName, 0 /* flags */, SYSTEM_UID, UserHandle.getUserId(callingUid)); + if (appInfo == null || appInfo.uid != callingUid) { + throw new SecurityException("Package " + packageName + " not in UID " + + callingUid); } + return appInfo.targetSdkVersion >= Build.VERSION_CODES.O; } - return false; } /**