Android BiometricService fingerprint unlock logic error enables unintended biometric device unlock

#!/usr/bin/env bash
# check_cve_2026_0017.sh
# Verify likely exposure to CVE-2026-0017 on an Android device via adb.
# Exit codes:
#   0 = PATCHED / not affected
#   1 = VULNERABLE
#   2 = UNKNOWN / insufficient data

set -u

SERIAL="${1:-}"
if [[ -z "$SERIAL" ]]; then
  echo "UNKNOWN - usage: $0 <device-serial>"
  exit 2
fi

ADB=(adb -s "$SERIAL")

if ! command -v adb >/dev/null 2>&1; then
  echo "UNKNOWN - adb not installed"
  exit 2
fi

if ! "${ADB[@]}" get-state >/dev/null 2>&1; then
  echo "UNKNOWN - device not reachable via adb"
  exit 2
fi

getprop_safe() {
  local key="$1"
  "${ADB[@]}" shell getprop "$key" 2>/dev/null | tr -d '\r'
}

getsetting_safe() {
  local namespace="$1"
  local key="$2"
  "${ADB[@]}" shell settings get "$namespace" "$key" 2>/dev/null | tr -d '\r'
}

RELEASE="$(getprop_safe ro.build.version.release)"
CODENAME="$(getprop_safe ro.build.version.codename)"
SPL="$(getprop_safe ro.build.version.security_patch)"
BUILD_ID="$(getprop_safe ro.build.id)"
FPG="$(getsetting_safe secure fingerprint_keyguard_enabled)"
BKG="$(getsetting_safe secure biometric_keyguard_enabled)"

if [[ -z "$RELEASE" && -z "$CODENAME" ]]; then
  echo "UNKNOWN - could not read Android version"
  exit 2
fi

# Normalize Android major. Android 16 may appear as "16" or preview codename during edge cases.
AFFECTED=0
if [[ "$RELEASE" == 16* ]]; then
  AFFECTED=1
fi

# If clearly not Android 16 lineage, treat as not affected by current public data.
if [[ $AFFECTED -eq 0 ]]; then
  echo "PATCHED - not in known affected Android 16 / 16-qpr2 population (release=$RELEASE codename=$CODENAME build=$BUILD_ID spl=$SPL)"
  exit 0
fi

# Require a security patch level to decide confidently.
if [[ ! "$SPL" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
  echo "UNKNOWN - Android 16 device but security patch level unavailable (release=$RELEASE build=$BUILD_ID fp_keyguard=$FPG biometric_keyguard=$BKG)"
  exit 2
fi

# Public vendor guidance places the fix in the March 2026 Android patch train.
FIXED_SINCE="2026-03-01"

if [[ "$SPL" < "$FIXED_SINCE" ]]; then
  echo "VULNERABLE - Android 16 lineage with security patch level before $FIXED_SINCE (release=$RELEASE build=$BUILD_ID spl=$SPL fp_keyguard=$FPG biometric_keyguard=$BKG)"
  exit 1
fi

# Patched by SPL; still surface suspicious state drift for operator follow-up.
if [[ "$FPG" == "1" && "$BKG" == "0" ]]; then
  echo "PATCHED - build is patched by SPL, but fingerprint unlock state looks worth reviewing (release=$RELEASE build=$BUILD_ID spl=$SPL fp_keyguard=$FPG biometric_keyguard=$BKG)"
  exit 0
fi

echo "PATCHED - Android 16 lineage with security patch level $SPL (release=$RELEASE build=$BUILD_ID fp_keyguard=$FPG biometric_keyguard=$BKG)"
exit 0