diff options
| author | 2023-02-09 16:00:02 -0800 | |
|---|---|---|
| committer | 2023-03-06 22:20:43 +0000 | |
| commit | 2fc07deafd257dcc934bb802887ef4297f49548f (patch) | |
| tree | 23f2da362255919b9dbee46e1e1f20a2d6391a15 /libs/androidfw/ApkParsing.cpp | |
| parent | d632a3978a64e14028426bf43b70e34a1ffa1565 (diff) | |
Fix vulnerability in AttributionSource due to incorrect Binder call
AttributionSource uses Binder.getCallingUid to verify the UID of the
caller from another process. However, getCallingUid does not always
behave as expected. If the AttributionSource is unparceled outside a
transaction thread, which is quite possible, getCallingUid will return
the UID of the current process instead. If this is a system process,
the UID check gets bypassed entirely, meaning any uid can be provided.
This patch fixes the vulnerability by emptying out the state of the
AttributionSource, so that the service checking its credentials will
fail to give permission to the app.
Bug: 267231571
Test: v2/android-virtual-infra/test_mapping/presubmit-avd
Merged-In: Ic301a8518b8e57e1c9a2c9f2f845e51dca145257
Change-Id: Ifdc53f87b7ef53b69cc01ec1955b4cb1dfd3345b
Merged-In: Ic985afdb5e4495f2e051e6d0d62d39c6660c585e
Diffstat (limited to 'libs/androidfw/ApkParsing.cpp')
0 files changed, 0 insertions, 0 deletions