Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce ComponentName belongs to caller app

Browse Source 
Add checks that enforce ComponentName's package belongs to calling app
in MediaButtonReceiverHolder and MediaSessionRecord. This avoids
privileged execution of arbitrary code.

Bug: 238177121
Test: atest CtsMediaBetterTogetherTestCases
Change-Id: Iac143d8bbc9422f3ca3f42f8c0154b9906ecd897
Merged-In: Iac143d8bbc9422f3ca3f42f8c0154b9906ecd897
This commit is contained in:
Iván Budnik
2022-07-19 13:22:09 +00:00
parent 7c5b922af8
commit b479180b73
2 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
services/core/java/com/android/server/media/MediaButtonReceiverHolder.java
View File

@@ -32,6 +32,7 @@ import android.os.Handler;
import android.os.PowerWhitelistManager;
import android.os.UserHandle;
import android.text.TextUtils;
import android.util.EventLog;
import android.util.Log;
import android.view.KeyEvent;
@@ -117,6 +118,12 @@ final class MediaButtonReceiverHolder {
int componentType = getComponentType(pendingIntent);
ComponentName componentName = getComponentName(pendingIntent, componentType);
if (componentName != null) {
if (!TextUtils.equals(componentName.getPackageName(), sessionPackageName)) {
EventLog.writeEvent(0x534e4554, "238177121", -1, ""); // SafetyNet logging
throw new IllegalArgumentException("ComponentName does not belong to "
+ "sessionPackageName. sessionPackageName = " + sessionPackageName
+ ", ComponentName pkg = " + componentName.getPackageName());
}
return new MediaButtonReceiverHolder(userId, pendingIntent, componentName,
componentType);
}

18
services/core/java/com/android/server/media/MediaSessionRecord.java
View File

@@ -53,6 +53,7 @@ import android.os.RemoteException;
import android.os.ResultReceiver;
import android.os.SystemClock;
import android.text.TextUtils;
import android.util.EventLog;
import android.util.Log;
import android.view.KeyEvent;
@@ -934,6 +935,14 @@ public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionR
@Override
public void setMediaButtonReceiver(PendingIntent pi, String sessionPackageName)
throws RemoteException {
//mPackageName has been verified in MediaSessionService.enforcePackageName().
if (!TextUtils.equals(sessionPackageName, mPackageName)) {
EventLog.writeEvent(0x534e4554, "238177121", -1, ""); // SafetyNet logging
throw new IllegalArgumentException("sessionPackageName name does not match "
+ "package name provided to MediaSessionRecord. sessionPackageName = "
+ sessionPackageName + ", pkg = "
+ mPackageName);
}
final long token = Binder.clearCallingIdentity();
try {
if ((mPolicies & MediaSessionPolicyProvider.SESSION_POLICY_IGNORE_BUTTON_RECEIVER)
@@ -952,6 +961,15 @@ public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionR
public void setMediaButtonBroadcastReceiver(ComponentName receiver) throws RemoteException {
final long token = Binder.clearCallingIdentity();
try {
//mPackageName has been verified in MediaSessionService.enforcePackageName().
if (receiver != null && !TextUtils.equals(
mPackageName, receiver.getPackageName())) {
EventLog.writeEvent(0x534e4554, "238177121", -1, ""); // SafetyNet logging
throw new IllegalArgumentException("receiver does not belong to "
+ "package name provided to MediaSessionRecord. Pkg = " + mPackageName
+ ", Receiver Pkg = " + receiver.getPackageName());
}
if ((mPolicies & MediaSessionPolicyProvider.SESSION_POLICY_IGNORE_BUTTON_RECEIVER)
!= 0) {
return;