tree f0bf630f5b8de6f68f353e63f71d5bf33ba59bcb
parent a2fda5da004a14d0cb46268d85cfeb07100861c8
author Teow Wan Yee <wy.teow@hi-p.com> 1474276836 +0800
committer Jeron Susan <jeron.susan@hi-p.com> 1474594760 +0800

FPII-2371 : Elevation of privilege vulnerability in ServiceManager
CVE-2016-3900 A-29431260

The ServiceManager determines whether the sender of a Binder transaction is
authorized to register a service. It looks up the senders SELinux context using getpidcon().
A race condition exists where getpidcon() could cause the wrong SELinux context to be used for a permission check.
The fix is designed to mitigate the exploitation path by adding a UID check
when registering a service.

Change-Id: Ie97cf3788ecc28a4a89484eb152a4deea07c2510