Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 5451c68c authored by James O'Leary's avatar James O'Leary
Browse files

WallpaperManagerService - avoid leaking whether a package is installed

An app can detect if an another app is installed, without holding the
appropriate permission, due to a difference in control flow. Catching
exceptions avoids a difference in control flow, and specifically
mitigates the bug report: a SecurityException thrown several steps
down the call chain is no longer thrown or logged.

The vulnerability took advantage of a difference in control flow
in WallpaperManagerService - if the calling app doesn't have the
READ_WALLPAPER_INTERNAL permission, WallpaperManagerService then checks
if the app has the READ_EXTERNAL_STORAGE/OP_READ_EXTERNAL_STORAGE
permission. If the app doesn't, a SecurityException is thrown several
levels down the call stack. The malicious app can check the text of that
exception, recognize it is a SecurityException, and recognize that the
exception text only occurs if there is no installed package name
with that package name.

Bug: 194105703
Test: Install test APK from Security. Verify it detects Gmail is
installed (com.google.android.gm). Apply patch. Verify it can no longer
detect Gmail is installed.

Change-Id: I4556f6cf367ec8b5a03d04d436dc0b7f93694d3a
parent 1d3b8a30
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment