jzy/TEESimulator-RS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(native): block attestation leak when interceptor service is dead

Browse Source 
When the Java interceptor process dies, callback->transact() returns
DEAD_OBJECT but the code fell through to the real keystore, exposing
genuine TEE state to requesting apps.

Add pingBinder() liveness check on pre-transact failure. If the
interceptor is confirmed dead, return DEAD_OBJECT to the caller
instead of forwarding to real hardware. Apps see a transient service
error rather than the actual device attestation state.
This commit is contained in:
Enginex0
2026-02-05 23:57:40 +01:00
committed by GKI Builder
parent 9aa4a33c5e
commit f276806096
1 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/main/cpp/binder_interceptor.cpp
+12 -4
View File
@@ -592,9 +592,16 @@ bool BinderInterceptor::processInterceptedTransaction(uint64_t tx_id, sp<BBinder
Parcel pre_req, pre_resp; Parcel pre_req, pre_resp;
writeTransactionData(pre_req, tx_id, target, code, flags, request); writeTransactionData(pre_req, tx_id, target, code, flags, request);
if (callback->transact(intercept::kPreTransact, pre_req, &pre_resp) != OK) { status_t pre_status = callback->transact(intercept::kPreTransact, pre_req, &pre_resp);
LOGW("[TX_ID: %" PRIu64 "] Pre-transaction callback failed. Forwarding original call.", tx_id); if (pre_status != OK) {
return false; // Callback failed, proceed as if not intercepted // Block when interceptor is dead to prevent privacy leak to third-party apps
if (callback->pingBinder() != OK) {
LOGE("[TX_ID: %" PRIu64 "] Interceptor DEAD. Blocking to prevent attestation leak.", tx_id);
result = DEAD_OBJECT;
return true;
}
LOGW("[TX_ID: %" PRIu64 "] Pre-transaction callback failed (not dead). Forwarding.", tx_id);
return false;
} }
int32_t action = pre_resp.readInt32(); int32_t action = pre_resp.readInt32();
@@ -647,7 +654,8 @@ bool BinderInterceptor::processInterceptedTransaction(uint64_t tx_id, sp<BBinder
VALIDATE_STATUS(tx_id, post_req.appendFrom(reply, 0, reply_size)); VALIDATE_STATUS(tx_id, post_req.appendFrom(reply, 0, reply_size));
} }
if (callback->transact(intercept::kPostTransact, post_req, &post_resp) == OK) { status_t post_status = callback->transact(intercept::kPostTransact, post_req, &post_resp);
if (post_status == OK) {
int32_t post_action = post_resp.readInt32(); int32_t post_action = post_resp.readInt32();
if (post_action == intercept::kActionOverrideReply && reply) { if (post_action == intercept::kActionOverrideReply && reply) {
result = post_resp.readInt32(); // Read new status result = post_resp.readInt32(); // Read new status