Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ced0695b authored by Azhara Assanova's avatar Azhara Assanova
Browse files

Make mutable PendingIntents explicit 

Starting from target SDK U, we will block creation of mutable
PendingIntents with implicit Intents because attackers can mutate the
Intent object within and launch altered behavior on behalf of victim
apps. For more details on the vulnerability, see go/pendingintent-rca.

From a quick analysis, we concluded that the PendingIntents here were
only destined to the test app/to the app, so they were made explicit.
Reviewers, please call out if this is not the case.

Bug: 236704164
Bug: 229362273
Test: atest FrameworksTelephonyTests
Change-Id: I71e4130d2139a2ac1c73c2fe67c8b0d71b1f928c
parent 870dae6d

src/java/com/android/internal/telephony/cat/CatService.java

+8 −4
Original line number Diff line number Diff line
@@ -618,11 +618,15 @@ public class CatService extends Handler implements AppInterface { 
    public void sendStkSms(String text, String destAddr, int subId, CommandParams cmdParams,

            ProxyController proxyController) {

        PendingIntent sentPendingIntent = PendingIntent.getBroadcast(mContext, 0,

                new Intent(SMS_SENT_ACTION).putExtra("cmdDetails",

                        cmdParams.mCmdDet), PendingIntent.FLAG_MUTABLE);

                new Intent(SMS_SENT_ACTION)

                        .putExtra("cmdDetails", cmdParams.mCmdDet)

                        .setPackage(mContext.getPackageName()),

                PendingIntent.FLAG_MUTABLE);

        PendingIntent deliveryPendingIntent = PendingIntent.getBroadcast(mContext, 0,

                new Intent(SMS_DELIVERY_ACTION).putExtra("cmdDetails",

                        cmdParams.mCmdDet), PendingIntent.FLAG_MUTABLE);

                new Intent(SMS_DELIVERY_ACTION)

                        .putExtra("cmdDetails", cmdParams.mCmdDet)

                        .setPackage(mContext.getPackageName()),

                PendingIntent.FLAG_MUTABLE);

        SmsController smsController = proxyController.getSmsController();

        smsController.sendTextForSubscriber(subId, mContext.getOpPackageName(),

                mContext.getAttributionTag(), destAddr, null, text, sentPendingIntent,

tests/telephonytests/src/com/android/internal/telephony/gsm/GsmSmsDispatcherTest.java

+9 −3
Original line number Diff line number Diff line
@@ -385,7 +385,9 @@ public class GsmSmsDispatcherTest extends TelephonyTest { 
        registerTestIntentReceiver();



        PendingIntent pendingIntent = PendingIntent.getBroadcast(TestApplication.getAppContext(), 0,

                new Intent(TEST_INTENT), PendingIntent.FLAG_MUTABLE);

                new Intent(TEST_INTENT)

                        .setPackage(TestApplication.getAppContext().getPackageName()),

                PendingIntent.FLAG_MUTABLE);

        mReceivedTestIntent = false;



        mGsmSmsDispatcher.sendText("6501002000", "121" /*scAddr*/, "test sms",
@@ -440,9 +442,13 @@ public class GsmSmsDispatcherTest extends TelephonyTest { 


        ArrayList<PendingIntent> sentIntents = new ArrayList<>();

        PendingIntent sentIntent1 = PendingIntent.getBroadcast(TestApplication.getAppContext(), 0,

                new Intent(TEST_INTENT), PendingIntent.FLAG_MUTABLE);

                new Intent(TEST_INTENT)

                        .setPackage(TestApplication.getAppContext().getPackageName()),

                PendingIntent.FLAG_MUTABLE);

        PendingIntent sentIntent2 = PendingIntent.getBroadcast(TestApplication.getAppContext(), 0,

                new Intent(TEST_INTENT), PendingIntent.FLAG_MUTABLE);

                new Intent(TEST_INTENT)

                        .setPackage(TestApplication.getAppContext().getPackageName()),

                PendingIntent.FLAG_MUTABLE);

        sentIntents.add(sentIntent1);

        sentIntents.add(sentIntent2);