Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix vulnerability in AttributionSource due to incorrect Binder call

Browse Source 
AttributionSource uses Binder.getCallingUid to verify the UID of the
caller from another process. However, getCallingUid does not always
behave as expected. If the AttributionSource is unparceled outside a
transaction thread, which is quite possible, getCallingUid will return
the UID of the current process instead. If this is a system process,
the UID check gets bypassed entirely, meaning any uid can be provided.

This patch fixes the vulnerability by enforcing that the AttributionSource
be unparceled in a transaction only. If it is not, a SecurityException
will be thrown.

Bug: 267231571
Test: Smoke test on cuttlefish.
Test: v2/android-virtual-infra/test_mapping/presubmit-avd
Change-Id: Ic301a8518b8e57e1c9a2c9f2f845e51dca145257
This commit is contained in:
Austin Borger
2023-02-09 16:00:02 -08:00
parent d2b13f4142
commit 922e52bc3d
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
core/java/android/content/AttributionSource.java
View File

@@ -155,6 +155,11 @@ public final class AttributionSource implements Parcelable {
AttributionSource(@NonNull Parcel in) { AttributionSource(@NonNull Parcel in) {
this(AttributionSourceState.CREATOR.createFromParcel(in)); this(AttributionSourceState.CREATOR.createFromParcel(in));
if (!Binder.isDirectlyHandlingTransaction()) {
throw new SecurityException("AttributionSource should be unparceled during a binder "
+ "transaction for proper verification.");
}
// Since we just unpacked this object as part of it transiting a Binder // Since we just unpacked this object as part of it transiting a Binder
// call, this is the perfect time to enforce that its UID and PID can be trusted // call, this is the perfect time to enforce that its UID and PID can be trusted
enforceCallingUidAndPid(); enforceCallingUidAndPid();