Skip to content

Commit 2093ccf

Browse files
AlamIntelAlamIntel
committed
Fix CVE_2025_22429 STS test failure
Addidng Aug 2025 removed patches which was removed during Tag r20 Upgradation STS r42 CVE_2025_22429 test passed Tracked-On: OAM-133999 Signed-off-by: Alam, SahibeX <sahibex.alam@intel.com>
1 parent a6765d4 commit 2093ccf

14 files changed

Lines changed: 1642 additions & 0 deletions

‎aosp_diff/preliminary/frameworks/base/0046-Remove-flag-fixAvatarCrossUserLeak.bulletin.patch‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
From 2b4d662a462c6b0269a6e6035ce443ec29fd860e Mon Sep 17 00:00:00 2001
2+
From: Anna Bauza <annabauza@google.com>
3+
Date: Tue, 26 Nov 2024 20:13:07 +0000
4+
Subject: [PATCH] Remove flag fixAvatarCrossUserLeak
5+
6+
Remove flag since this is a security fix and missing the flag on security branch is causing build failure.
7+
8+
Bug: 341688848
9+
Test: N/A
10+
Flag: EXEMPT bugfix
11+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:2ab1084a748a2303289624e6063d2c60d10ec922)
12+
Merged-In: I7d92e0bdb750a5e0a81e9bfd03ea50686c82f6e0
13+
Change-Id: I7d92e0bdb750a5e0a81e9bfd03ea50686c82f6e0
14+
---
15+
.../settingslib/users/EditUserPhotoController.java | 10 ++++------
16+
1 file changed, 4 insertions(+), 6 deletions(-)
17+
18+
diff --git a/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java b/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java
19+
index f38e91ac0d8a..0143e5ebf116 100644
20+
--- a/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java
21+
+++ b/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java
22+
@@ -134,12 +134,10 @@ public class EditUserPhotoController {
23+
if (Flags.avatarSync()) {
24+
intent.putExtra(EXTRA_IS_USER_NEW, isUserNew);
25+
// Fix vulnerability b/341688848 by explicitly set the class name of avatar picker.
26+
- if (Flags.fixAvatarCrossUserLeak()) {
27+
- final String packageName =
28+
- mActivity.getString(R.string.config_avatar_picker_package);
29+
- final String className = mActivity.getString(R.string.config_avatar_picker_class);
30+
- intent.setClassName(packageName, className);
31+
- }
32+
+ final String packageName =
33+
+ mActivity.getString(R.string.config_avatar_picker_package);
34+
+ final String className = mActivity.getString(R.string.config_avatar_picker_class);
35+
+ intent.setClassName(packageName, className);
36+
} else {
37+
// SettingsLib is used by multiple apps therefore we need to know out of all apps
38+
// using settingsLib which one is the one we return value to.
39+
--
40+
2.48.1.262.g85cc9f2d1e-goog
41+

‎aosp_diff/preliminary/frameworks/base/0047-Verify-that-the-caller-has-permissions-for-the-icons-it-provided.bulletin.patch‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
From ee65c97e3a19224548376ca2b7bd93fe366e94e8 Mon Sep 17 00:00:00 2001
2+
From: Andrey Yepin <ayepin@google.com>
3+
Date: Mon, 9 Dec 2024 21:34:17 -0800
4+
Subject: [PATCH] Verify that the caller has permissions for the icons it
5+
provided.
6+
7+
Bug: 277207798
8+
Test: manual testing: first reroduce the issue as described in the
9+
ticket then check that it is not reproduceable after the fix.
10+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:bad47a2280c7107e1213f4adc5a3825a62698d00)
11+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c108d3866a3e6b1d7780325d862f20450a36d573)
12+
Merged-In: I08992550507572a4878c501184360a58adef53ad
13+
Change-Id: I08992550507572a4878c501184360a58adef53ad
14+
---
15+
.../android/internal/app/ChooserActivity.java | 50 ++++++++++++++++++-
16+
1 file changed, 49 insertions(+), 1 deletion(-)
17+
18+
diff --git a/core/java/com/android/internal/app/ChooserActivity.java b/core/java/com/android/internal/app/ChooserActivity.java
19+
index ab456a84d9ad..3911777912ca 100644
20+
--- a/core/java/com/android/internal/app/ChooserActivity.java
21+
+++ b/core/java/com/android/internal/app/ChooserActivity.java
22+
@@ -21,6 +21,7 @@ import static android.app.admin.DevicePolicyResources.Strings.Core.RESOLVER_CANT
23+
import static android.app.admin.DevicePolicyResources.Strings.Core.RESOLVER_CANT_SHARE_WITH_PERSONAL;
24+
import static android.app.admin.DevicePolicyResources.Strings.Core.RESOLVER_CANT_SHARE_WITH_WORK;
25+
import static android.app.admin.DevicePolicyResources.Strings.Core.RESOLVER_CROSS_PROFILE_BLOCKED_TITLE;
26+
+import static android.content.ContentProvider.getUriWithoutUserId;
27+
import static android.content.ContentProvider.getUserIdFromUri;
28+
import static android.stats.devicepolicy.DevicePolicyEnums.RESOLVER_EMPTY_STATE_NO_SHARING_TO_PERSONAL;
29+
import static android.stats.devicepolicy.DevicePolicyEnums.RESOLVER_EMPTY_STATE_NO_SHARING_TO_WORK;
30+
@@ -40,7 +41,9 @@ import android.annotation.Nullable;
31+
import android.app.Activity;
32+
import android.app.ActivityManager;
33+
import android.app.ActivityOptions;
34+
+import android.app.IUriGrantsManager;
35+
import android.app.SharedElementCallback;
36+
+import android.app.UriGrantsManager;
37+
import android.app.prediction.AppPredictionContext;
38+
import android.app.prediction.AppPredictionManager;
39+
import android.app.prediction.AppPredictor;
40+
@@ -77,6 +80,7 @@ import android.graphics.Paint;
41+
import android.graphics.Path;
42+
import android.graphics.drawable.AnimatedVectorDrawable;
43+
import android.graphics.drawable.Drawable;
44+
+import android.graphics.drawable.Icon;
45+
import android.metrics.LogMaker;
46+
import android.net.Uri;
47+
import android.os.AsyncTask;
48+
@@ -86,6 +90,7 @@ import android.os.Handler;
49+
import android.os.Message;
50+
import android.os.Parcelable;
51+
import android.os.PatternMatcher;
52+
+import android.os.RemoteException;
53+
import android.os.ResultReceiver;
54+
import android.os.UserHandle;
55+
import android.os.UserManager;
56+
@@ -684,7 +689,11 @@ public class ChooserActivity extends ResolverActivity implements
57+
targets = null;
58+
break;
59+
}
60+
- targets[i] = (ChooserTarget) pa[i];
61+
+ ChooserTarget chooserTarget = (ChooserTarget) pa[i];
62+
+ if (!hasValidIcon(chooserTarget)) {
63+
+ chooserTarget = removeIcon(chooserTarget);
64+
+ }
65+
+ targets[i] = chooserTarget;
66+
}
67+
mCallerChooserTargets = targets;
68+
}
69+
@@ -4206,4 +4215,43 @@ public class ChooserActivity extends ResolverActivity implements
70+
private boolean shouldNearbyShareBeIncludedAsActionButton() {
71+
return !shouldNearbyShareBeFirstInRankedRow();
72+
}
73+
+
74+
+ private boolean hasValidIcon(ChooserTarget target) {
75+
+ Icon icon = target.getIcon();
76+
+ if (icon == null) {
77+
+ return true;
78+
+ }
79+
+ if (icon.getType() == Icon.TYPE_URI || icon.getType() == Icon.TYPE_URI_ADAPTIVE_BITMAP) {
80+
+ Uri uri = icon.getUri();
81+
+ try {
82+
+ getUriGrantsManager().checkGrantUriPermission_ignoreNonSystem(
83+
+ getLaunchedFromUid(),
84+
+ getPackageName(),
85+
+ getUriWithoutUserId(uri),
86+
+ Intent.FLAG_GRANT_READ_URI_PERMISSION,
87+
+ getUserIdFromUri(uri)
88+
+ );
89+
+ } catch (SecurityException | RemoteException e) {
90+
+ Log.e(TAG, "Failed to get URI permission for: " + uri, e);
91+
+ return false;
92+
+ }
93+
+ }
94+
+ return true;
95+
+ }
96+
+
97+
+ private IUriGrantsManager getUriGrantsManager() {
98+
+ return UriGrantsManager.getService();
99+
+ }
100+
+
101+
+ private static ChooserTarget removeIcon(ChooserTarget target) {
102+
+ if (target == null) {
103+
+ return null;
104+
+ }
105+
+ return new ChooserTarget(
106+
+ target.getTitle(),
107+
+ null,
108+
+ target.getScore(),
109+
+ target.getComponentName(),
110+
+ target.getIntentExtras());
111+
+ }
112+
}
113+
--
114+
2.48.1.262.g85cc9f2d1e-goog
115+

‎aosp_diff/preliminary/frameworks/base/0048-Fix-Block-opening-settings-app-on-keyguard-without-u.patch‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
From 98a78553442199cc8601d6446081619be1471ac4 Mon Sep 17 00:00:00 2001
2+
From: Vaibhav Devmurari <vdevmurari@google.com>
3+
Date: Mon, 9 Dec 2024 13:15:03 +0000
4+
Subject: [PATCH] Fix: Block opening settings app on keyguard without user auth
5+
6+
Test: atest KeyGestureEventTests
7+
Bug: 378900798
8+
Flag: EXEMPT bugfix
9+
(cherry picked from commit d615298466085c4a88c6733804160e0c1ee7e31e)
10+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e4d483a2ef99a71c6fcd6ad2e6c2f8f88ba380f4)
11+
Merged-In: I89d43872108710d20e0c4ef7e652d389896155d7
12+
Change-Id: I89d43872108710d20e0c4ef7e652d389896155d7
13+
---
14+
.../core/java/com/android/server/policy/PhoneWindowManager.java | 2 +-
15+
1 file changed, 1 insertion(+), 1 deletion(-)
16+
17+
diff --git a/services/core/java/com/android/server/policy/PhoneWindowManager.java b/services/core/java/com/android/server/policy/PhoneWindowManager.java
18+
index f1a481155458..23b448b064c4 100644
19+
--- a/services/core/java/com/android/server/policy/PhoneWindowManager.java
20+
+++ b/services/core/java/com/android/server/policy/PhoneWindowManager.java
21+
@@ -3576,7 +3576,7 @@ public class PhoneWindowManager implements WindowManagerPolicy {
22+
}
23+
break;
24+
case KeyEvent.KEYCODE_I:
25+
- if (firstDown && event.isMetaPressed()) {
26+
+ if (firstDown && event.isMetaPressed() && isUserSetupComplete() && !keyguardOn) {
27+
showSystemSettings();
28+
notifyKeyGestureCompleted(event,
29+
KeyGestureEvent.KEY_GESTURE_TYPE_LAUNCH_SYSTEM_SETTINGS);
30+
--
31+
2.34.1
32+

‎aosp_diff/preliminary/frameworks/base/0049-BaseBundle-fix-unparcel-error-logic.bulletin.patch‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
From 567af706fd9db016b0b7a7c4ffc5e2b2fd3bbb5f Mon Sep 17 00:00:00 2001
2+
From: Steven Moreland <smoreland@google.com>
3+
Date: Tue, 10 Dec 2024 21:54:36 +0000
4+
Subject: [PATCH] BaseBundle: fix unparcel error logic
5+
6+
This code considered a success case to be an unsuccessful
7+
case.
8+
9+
Bug: 373357090
10+
Test: repro in bug no longer works
11+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:86cfb77a4664110c44ea147e8457a65e69e6d5d9)
12+
Merged-In: Id423936872cbb0e0265ccf2855092357cb175d47
13+
Change-Id: Id423936872cbb0e0265ccf2855092357cb175d47
14+
---
15+
core/java/android/os/BaseBundle.java | 10 +++++-----
16+
core/java/android/os/Parcel.java | 12 +++++-------
17+
2 files changed, 10 insertions(+), 12 deletions(-)
18+
19+
diff --git a/core/java/android/os/BaseBundle.java b/core/java/android/os/BaseBundle.java
20+
index 49ab15a40a8e..36a1c1b08289 100644
21+
--- a/core/java/android/os/BaseBundle.java
22+
+++ b/core/java/android/os/BaseBundle.java
23+
@@ -471,10 +471,10 @@ public class BaseBundle {
24+
map.erase();
25+
map.ensureCapacity(count);
26+
}
27+
- int numLazyValues = 0;
28+
+ int[] numLazyValues = new int[]{0};
29+
try {
30+
- numLazyValues = parcelledData.readArrayMap(map, count, !parcelledByNative,
31+
- /* lazy */ ownsParcel, mClassLoader);
32+
+ parcelledData.readArrayMap(map, count, !parcelledByNative,
33+
+ /* lazy */ ownsParcel, mClassLoader, numLazyValues);
34+
} catch (BadParcelableException e) {
35+
if (sShouldDefuse) {
36+
Log.w(TAG, "Failed to parse Bundle, but defusing quietly", e);
37+
@@ -485,14 +485,14 @@ public class BaseBundle {
38+
} finally {
39+
mWeakParcelledData = null;
40+
if (ownsParcel) {
41+
- if (numLazyValues == 0) {
42+
+ if (numLazyValues[0] == 0) {
43+
recycleParcel(parcelledData);
44+
} else {
45+
mWeakParcelledData = new WeakReference<>(parcelledData);
46+
}
47+
}
48+
49+
- mLazyValues = numLazyValues;
50+
+ mLazyValues = numLazyValues[0];
51+
mParcelledByNative = false;
52+
mMap = map;
53+
// Set field last as it is volatile
54+
diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java
55+
index 136c45d1695f..b6eac10413aa 100644
56+
--- a/core/java/android/os/Parcel.java
57+
+++ b/core/java/android/os/Parcel.java
58+
@@ -5519,7 +5519,7 @@ public final class Parcel {
59+
60+
private void readArrayMapInternal(@NonNull ArrayMap<? super String, Object> outVal,
61+
int size, @Nullable ClassLoader loader) {
62+
- readArrayMap(outVal, size, /* sorted */ true, /* lazy */ false, loader);
63+
+ readArrayMap(outVal, size, /* sorted */ true, /* lazy */ false, loader, null);
64+
}
65+
66+
/**
67+
@@ -5529,17 +5529,16 @@ public final class Parcel {
68+
* @param lazy Whether to populate the map with lazy {@link Function} objects for
69+
* length-prefixed values. See {@link Parcel#readLazyValue(ClassLoader)} for more
70+
* details.
71+
- * @return a count of the lazy values in the map
72+
+ * @param lazyValueCount number of lazy values added here
73+
* @hide
74+
*/
75+
- int readArrayMap(ArrayMap<? super String, Object> map, int size, boolean sorted,
76+
- boolean lazy, @Nullable ClassLoader loader) {
77+
- int lazyValues = 0;
78+
+ void readArrayMap(ArrayMap<? super String, Object> map, int size, boolean sorted,
79+
+ boolean lazy, @Nullable ClassLoader loader, int[] lazyValueCount) {
80+
while (size > 0) {
81+
String key = readString();
82+
Object value = (lazy) ? readLazyValue(loader) : readValue(loader);
83+
if (value instanceof LazyValue) {
84+
- lazyValues++;
85+
+ lazyValueCount[0]++;
86+
}
87+
if (sorted) {
88+
map.append(key, value);
89+
@@ -5551,7 +5550,6 @@ public final class Parcel {
90+
if (sorted) {
91+
map.validate();
92+
}
93+
- return lazyValues;
94+
}
95+
96+
/**
97+
--
98+
2.48.1.262.g85cc9f2d1e-goog
99+

‎aosp_diff/preliminary/frameworks/base/0050-Check-underlying-intent-as-well-as-intent-selector.bulletin.patch‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
From 8612a293fb4ae27225454db9463f38a925cd4d46 Mon Sep 17 00:00:00 2001
2+
From: oli <olit@google.com>
3+
Date: Tue, 28 Jan 2025 16:28:31 +0000
4+
Subject: [PATCH] Check underlying intent as well as intent selector
5+
6+
When checking if an intent can be forwarded across profiles, the
7+
selector action is checked rather than the intent itself.
8+
This means badIntents can be spoofed with a different selector and
9+
launched across profiles.
10+
11+
Bug: 376674080
12+
Test: manually tested
13+
Flag: EXEMPT bugfix
14+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:fc28861349e0113f807016501da3e1fd963b59fa)
15+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:dc7e4fffc58d535c6eaba6c382c8c89e35136389)
16+
Merged-In: If04e1020fc5a09f04630ba08d7e3b3012f2aa577
17+
Change-Id: If04e1020fc5a09f04630ba08d7e3b3012f2aa577
18+
---
19+
.../internal/app/IntentForwarderActivity.java | 27 +++++++++++++------
20+
1 file changed, 19 insertions(+), 8 deletions(-)
21+
22+
diff --git a/core/java/com/android/internal/app/IntentForwarderActivity.java b/core/java/com/android/internal/app/IntentForwarderActivity.java
23+
index d72207d9b9ef..a1bb325534dd 100644
24+
--- a/core/java/com/android/internal/app/IntentForwarderActivity.java
25+
+++ b/core/java/com/android/internal/app/IntentForwarderActivity.java
26+
@@ -586,24 +586,35 @@ public class IntentForwarderActivity extends Activity {
27+
Intent.FLAG_ACTIVITY_FORWARD_RESULT | Intent.FLAG_ACTIVITY_PREVIOUS_IS_TOP);
28+
sanitizeIntent(forwardIntent);
29+
30+
- Intent intentToCheck = forwardIntent;
31+
- if (Intent.ACTION_CHOOSER.equals(forwardIntent.getAction())) {
32+
+ if (!canForwardInner(forwardIntent, sourceUserId, targetUserId, packageManager,
33+
+ contentResolver)) {
34+
return null;
35+
}
36+
if (forwardIntent.getSelector() != null) {
37+
- intentToCheck = forwardIntent.getSelector();
38+
+ sanitizeIntent(forwardIntent.getSelector());
39+
+ if (!canForwardInner(forwardIntent.getSelector(), sourceUserId, targetUserId,
40+
+ packageManager, contentResolver)) {
41+
+ return null;
42+
+ }
43+
+ }
44+
+ return forwardIntent;
45+
+ }
46+
+
47+
+ private static boolean canForwardInner(Intent intent, int sourceUserId, int targetUserId,
48+
+ IPackageManager packageManager, ContentResolver contentResolver) {
49+
+ if (Intent.ACTION_CHOOSER.equals(intent.getAction())) {
50+
+ return false;
51+
}
52+
- String resolvedType = intentToCheck.resolveTypeIfNeeded(contentResolver);
53+
- sanitizeIntent(intentToCheck);
54+
+ String resolvedType = intent.resolveTypeIfNeeded(contentResolver);
55+
try {
56+
if (packageManager.canForwardTo(
57+
- intentToCheck, resolvedType, sourceUserId, targetUserId)) {
58+
- return forwardIntent;
59+
+ intent, resolvedType, sourceUserId, targetUserId)) {
60+
+ return true;
61+
}
62+
} catch (RemoteException e) {
63+
Slog.e(TAG, "PackageManagerService is dead?");
64+
}
65+
- return null;
66+
+ return false;
67+
}
68+
69+
/**
70+
--
71+
2.48.1.262.g85cc9f2d1e-goog
72+

0 commit comments

Comments
 (0)