复现一个有争议的安卓漏洞，是严重还是中危？是权限提升还是信息泄露？

diff --git a/services/credentials/java/com/android/server/credentials/CredentialManagerUi.java b/services/credentials/java/com/android/server/credentials/CredentialManagerUi.java
index 272452e..6589503 100644
--- a/services/credentials/java/com/android/server/credentials/CredentialManagerUi.java
+++ b/services/credentials/java/com/android/server/credentials/CredentialManagerUi.java
@@ -32,6 +32,7 @@
 import android.os.IBinder;
 import android.os.Looper;
 import android.os.ResultReceiver;
+import android.os.UserHandle;
 import android.service.credentials.CredentialProviderInfoFactory;
 import android.util.Slog;
 
@@ -171,7 +172,9 @@
                 .setAction(UUID.randomUUID().toString());
         //TODO: Create unique pending intent using request code and cancel any pre-existing pending
         // intents
- return PendingIntent.getActivity(
- mContext, /*requestCode=*/0, intent, PendingIntent.FLAG_IMMUTABLE);
+ return PendingIntent.getActivityAsUser(
+ mContext, /*requestCode=*/0, intent,
+ PendingIntent.FLAG_IMMUTABLE, /*options=*/null,
+ UserHandle.of(mUserId));
     }
 }

➜ ~ adb shell pm list users
Users:
  UserInfo{0:Owner:c13} running
  UserInfo{10:Guest:404}

public PendingIntent createPendingIntent(
            RequestInfo requestInfo, ArrayList<ProviderData> providerDataList) {
        List<CredentialProviderInfo> allProviders =
                CredentialProviderInfoFactory.getCredentialProviderServices(
                        mContext,
                        mUserId,
                        CredentialManager.PROVIDER_FILTER_USER_PROVIDERS_ONLY,
                        mEnabledProviders,
                        // Don't need primary providers here.
                        new HashSet<ComponentName>());

        List<DisabledProviderData> disabledProviderDataList = allProviders.stream()
                .filter(provider -> !provider.isEnabled())
                .map(disabledProvider -> new DisabledProviderData(
                        disabledProvider.getComponentName().flattenToString())).toList();

        Intent intent = IntentFactory.createCredentialSelectorIntent(requestInfo, providerDataList,
                        new ArrayList<>(disabledProviderDataList), mResultReceiver)
                .setAction(UUID.randomUUID().toString());
        //TODO: Create unique pending intent using request code and cancel any pre-existing pending
        // intents
        return PendingIntent.getActivityAsUser(
                mContext, /*requestCode=*/0, intent,
                PendingIntent.FLAG_IMMUTABLE, /*options=*/null,
                UserHandle.of(mUserId)); //补丁位置
    }

public class IntentFactory {
    /** Generate a new launch intent to the Credential Selector UI. */
    @NonNull
    public static Intent createCredentialSelectorIntent(
            @NonNull RequestInfo requestInfo,
            @SuppressLint("ConcreteCollection") // Concrete collection needed for marshalling.
                    @NonNull
                    ArrayList<ProviderData> enabledProviderDataList,
            @SuppressLint("ConcreteCollection") // Concrete collection needed for marshalling.
                    @NonNull
                    ArrayList<DisabledProviderData> disabledProviderDataList,
            @NonNull ResultReceiver resultReceiver) {
        Intent intent = new Intent();
        ComponentName componentName =
                ComponentName.unflattenFromString(
                        Resources.getSystem()
                                .getString(
                                        com.android.internal.R.string
                                                .config_credentialManagerDialogComponent));
        intent.setComponent(componentName);

        intent.putParcelableArrayListExtra(
                ProviderData.EXTRA_ENABLED_PROVIDER_DATA_LIST, enabledProviderDataList);
        intent.putParcelableArrayListExtra(
                ProviderData.EXTRA_DISABLED_PROVIDER_DATA_LIST, disabledProviderDataList);
        intent.putExtra(RequestInfo.EXTRA_REQUEST_INFO, requestInfo);
        intent.putExtra(
                Constants.EXTRA_RESULT_RECEIVER, toIpcFriendlyResultReceiver(resultReceiver));

        return intent;
    }

<!-- Name of the dialog that is used to get or save an app credential -->
    <string name="config_credentialManagerDialogComponent" translatable="false"
            >com.android.credentialmanager/com.android.credentialmanager.CredentialSelectorActivity</string>

ActivityTaskManager system_server I START u0 {act=eb61b74d-2ea4-4919-9d40-54740f06d419 cmp=com.android.credentialmanager/.CredentialSelectorActivity (has extras)} with LAUNCH_SINGLE_TOP from uid 1000 (realCallingUid=1010190) (BAL_ALLOW_ALLOWLISTED_UID) result code=0

protected void launchUiWithProviderData(ArrayList<ProviderData> providerDataList) {
        mRequestSessionMetric.collectUiCallStartTime(System.nanoTime());
        mCredentialManagerUi.setStatus(CredentialManagerUi.UiStatus.USER_INTERACTION);
        Binder.withCleanCallingIdentity(()-> {
        try {
                cancelExistingPendingIntent();
            mPendingIntent = mCredentialManagerUi.createPendingIntent(
                    RequestInfo.newGetRequestInfo(
                            mRequestId, mClientRequest, mClientAppInfo.getPackageName(),
                            PermissionUtils.hasPermission(mContext, mClientAppInfo.getPackageName(),
                                    Manifest.permission.CREDENTIAL_MANAGER_SET_ALLOWED_PROVIDERS)),
                    providerDataList);
            mClientCallback.onPendingIntent(mPendingIntent);
        } catch (RemoteException e) {
            mRequestSessionMetric.collectUiReturnedFinalPhase(/*uiReturned=*/ false);
            mCredentialManagerUi.setStatus(CredentialManagerUi.UiStatus.TERMINATED);
            String exception = GetCredentialException.TYPE_UNKNOWN;
            mRequestSessionMetric.collectFrameworkException(exception);
                respondToClientWithErrorAndFinish(exception, "Unable to instantiate selector");
            }
        });
    }

void getProviderDataAndInitiateUi() {
        ArrayList<ProviderData> providerDataList = getProviderDataForUi();
        if (!providerDataList.isEmpty()) {
            launchUiWithProviderData(providerDataList);
        }
    }

    @NonNull
    protected ArrayList<ProviderData> getProviderDataForUi() {
        Slog.i(TAG, "For ui, provider data size: " + mProviders.size());
        ArrayList<ProviderData> providerDataList = new ArrayList<>();
        mRequestSessionMetric.logCandidatePhaseMetrics(mProviders);

        if (isSessionCancelled()) {
            finishSession(/*propagateCancellation=*/true);
            return providerDataList;
        }

        for (ProviderSession session : mProviders.values()) {
            ProviderData providerData = session.prepareUiData();
            if (providerData != null) {
                providerDataList.add(providerData);
            }
        }
        return providerDataList;
    }接着看session.prepareUiData()这个函数session有四种类型
对于获取账号的场景，对应ProviderGetSession。session创建的构造函数：
public static ProviderGetSession createNewSession(
            Context context,
            @UserIdInt int userId,
            CredentialProviderInfo providerInfo,
            GetRequestSession getRequestSession,
            RemoteCredentialService remoteCredentialService) {
        android.credentials.GetCredentialRequest filteredRequest =
                filterOptions(providerInfo.getCapabilities(),
                        getRequestSession.mClientRequest,
                        providerInfo);
        if (filteredRequest != null) {
            Map<String, CredentialOption> beginGetOptionToCredentialOptionMap =
                    new HashMap<>();
            return new ProviderGetSession(
                    context,
                    providerInfo,
                    getRequestSession,
                    userId,
                    remoteCredentialService,
                    constructQueryPhaseRequest(
                            filteredRequest, getRequestSession.mClientAppInfo,
                            getRequestSession.mClientRequest.alwaysSendAppInfoToProvider(),
                            beginGetOptionToCredentialOptionMap),
                    filteredRequest,
                    getRequestSession.mClientAppInfo,
                    beginGetOptionToCredentialOptionMap,
                    getRequestSession.mHybridService
            );
        }
        Slog.i(TAG, "Unable to create provider session for: "
                + providerInfo.getComponentName());
        return null;
    }


输入参数中有一个关键的参数userId，这个参数来自于调用方的UserId。

final class CredentialManagerServiceStub extends ICredentialManager.Stub {
        @Override
        public ICancellationSignal executeGetCredential(
                GetCredentialRequest request,
                IGetCredentialCallback callback,
                final String callingPackage) {
            final long timestampBegan = System.nanoTime();
            Slog.i(TAG, "starting executeGetCredential with callingPackage: "
                    + callingPackage);
            ICancellationSignal cancelTransport = CancellationSignal.createTransport();

            final int userId = UserHandle.getCallingUserId();
            final int callingUid = Binder.getCallingUid();
            enforceCallingPackage(callingPackage, callingUid);

            validateGetCredentialRequest(request);

            // New request session, scoped for this request only.
            final GetRequestSession session =
                    new GetRequestSession(
                            getContext(),
                            mSessionManager,
                            mLock,
                            userId,
                            callingUid,
                            callback,
                            request,
                            constructCallingAppInfo(callingPackage, userId, request.getOrigin()),
                            getEnabledProvidersForUser(userId),
                            CancellationSignal.fromTransport(cancelTransport),
                            timestampBegan);
            addSessionLocked(userId, session);




在此可以推断，当在其他用户，比如Guest用户执行GetCredential时，
创建的session属于Guest用户，并且获取到的是和Guest绑定的账号信
息。

系统中有两个com.google.android.gms进程，分别属于Owner用户和Guest用户。经过调试，在Guest用户下访问的Service隶属于Guest用户，而非Owner用户。因此获取到的账户信息属于和Guest绑定的账号信息。只是获取到的账号信息通过Intent的方式传递给了Owner用户下的Activity。



ActivityTaskManager system_server I START u0 {act=eb61b74d-2ea4-4919-9d40-54740f06d419 cmp=com.android.credentialmanager/.CredentialSelectorActivity (has extras)} with LAUNCH_SINGLE_TOP from uid 1000 (realCallingUid=1010190) (BAL_ALLOW_ALLOWLISTED_UID) result code=0










结论









结论一：在其他用户运行的app可以在Owner用户空间内打开Activity，实现权限提升.
结论二：Guest用户运行的app获取到账号信息，获取的是Guest用户，而非Owner用户；获取到的信息传递给Owner用户，需要交互确认，但目前还没找到可以提取账号信息的方法。


因此，属于一个中风险漏洞，且只是一个本地权限漏洞，而非信息泄露漏洞。
当然也存在有未考虑到的地方，欢迎大家私信讨论。










测试代码














private static void getPasswordRequest(Context context) {
        CredentialManager credentialManager = CredentialManager.create(context);

        GetPasswordOption getPasswordOption = new GetPasswordOption();

        GetCredentialRequest getCredentialRequest = new androidx.credentials.GetCredentialRequest.Builder()
                .addCredentialOption(getPasswordOption)
                .setPreferImmediatelyAvailableCredentials(true)
                .build();

        credentialManager.getCredentialAsync(context, getCredentialRequest, new CancellationSignal(), new Executor() {
            @Override
            public void execute(Runnable command) {

                command.run();
            }
        }, new CredentialManagerCallback<GetCredentialResponse, GetCredentialException>() {
            @Override
            public void onResult(GetCredentialResponse getCredentialResponse) {
                Log.d("getPasswordRequest", getCredentialResponse.getCredential().getData().toString());
            }

            @Override
            public void onError(@NonNull GetCredentialException e) {

            }
        });