Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5d79e535 authored by Lokesh Kumar Goel's avatar Lokesh Kumar Goel Committed by Austin Borger
Browse files

Fix vulnerability in AttributionSource due to incorrect Binder call 

AttributionSource uses Binder.getCallingUid to verify the UID of the
caller from another process. However, getCallingUid does not always
behave as expected. If the AttributionSource is unparceled outside a
transaction thread, which is quite possible, getCallingUid will return
the UID of the current process instead. If this is a system process,
the UID check gets bypassed entirely, meaning any uid can be provided.

This patch fixes the vulnerability by emptying out the state of the
AttributionSource, so that the service checking its credentials will
fail to give permission to the app.

Bug: 267231571
Test: v2/android-virtual-infra/test_mapping/presubmit-avd
Merged-In: Ic301a8518b8e57e1c9a2c9f2f845e51dca145257
Change-Id: I3f228064fbd62e1c907f1ebe870cb61102f788f0
parent 8ab8c751

core/java/android/content/AttributionSource.java

+17 −3
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ import android.os.Parcelable; 
import android.os.Process;

import android.permission.PermissionManager;

import android.util.ArraySet;

import android.util.Log;



import com.android.internal.annotations.Immutable;
@@ -87,6 +88,8 @@ import java.util.Set; 
 */

@Immutable

public final class AttributionSource implements Parcelable {

    private static final String TAG = "AttributionSource";



    private static final String DESCRIPTOR = "android.content.AttributionSource";



    private static final Binder sDefaultToken = new Binder(DESCRIPTOR);
@@ -154,10 +157,21 @@ public final class AttributionSource implements Parcelable { 
    AttributionSource(@NonNull Parcel in) {

        this(AttributionSourceState.CREATOR.createFromParcel(in));



        if (!Binder.isDirectlyHandlingTransaction()) {

            Log.e(TAG, "Unable to verify calling UID #" + mAttributionSourceState.uid + " PID #"

                    + mAttributionSourceState.pid + " when not handling Binder transaction; "

                    + "clearing.");

            mAttributionSourceState.pid = -1;

            mAttributionSourceState.uid = -1;

            mAttributionSourceState.packageName = null;

            mAttributionSourceState.attributionTag = null;

            mAttributionSourceState.next = null;

        } else {

            // Since we just unpacked this object as part of it transiting a Binder

            // call, this is the perfect time to enforce that its UID and PID can be trusted

            enforceCallingUidAndPid();

        }

    }



    /** @hide */

    public AttributionSource(@NonNull AttributionSourceState attributionSourceState) {