CVE-2020-0071: 
NixOS vulnerability analysis and mitigation

An Out-Of-Bounds write vulnerability was discovered in Android's rw_t2t_extract_default_locks_info function, identified as CVE-2020-0071. The vulnerability affects multiple Android versions including Android 8.0, 8.1, 9, and 10. This security flaw was discovered in January 2020 and was publicly disclosed in April 2020 as part of the Android Security Bulletin (GitHub Lab, CVE Mitre).

The vulnerability exists in the rw_t2t_extract_default_locks_info function within the rw_t2t_ndef.cc file. The issue occurs because num_dynamic_lock_bytes is derived from p_t2t->tag_hdr[T2T_CC2_TMS_BYTE] without proper bounds checking. When a tag_hdr with a sufficiently large T2T_CC2_TMS_BYTE value is provided in the initial response, num_dynamic_lock_bytes can exceed the size of p_t2t->lockbytes, resulting in an out-of-bounds write condition (GitHub Lab).

If successfully exploited, this vulnerability could lead to remote code execution over NFC with no additional execution privileges needed. The attack can be executed without user interaction, making it particularly dangerous. The vulnerability affects the Android NFC daemon, potentially compromising the security of the device's NFC functionality (CVE Mitre).

The vulnerability can be exploited by an attacker within NFC range of the target device. No user interaction is required for exploitation, and no additional execution privileges are needed. A proof-of-concept exists demonstrating that by using a specially crafted tag_hdr with specific values, an attacker could trigger the out-of-bounds write condition (GitHub Lab).

The vulnerability was addressed in the Android Security Patch released on April 1, 2020. Users are advised to update their Android devices to the latest security patch level to protect against this vulnerability. The fix was implemented in the Android Open Source Project (AOSP) (GitHub Lab).