CVE-2020-0073: 
NixOS vulnerability analysis and mitigation

CVE-2020-0073 is a critical out-of-bounds write vulnerability discovered in Android's NFC system component, specifically in the rw_t2t_handle_tlv_detect_rsp function. The vulnerability was disclosed in April 2020 and affects Android versions 8.0, 8.1, 9, and 10. This security flaw was identified as part of a set of critical vulnerabilities addressed in Android's April 2020 security patch (GitHub Advisory, SecurityWeek).

The vulnerability exists in the rw_t2t_handle_tlv_detect_rsp function where p_t2t->lockbyte is accessed with the index p_t2t->num_lockbytes. Although there is a check to ensure p_t2t->num_lockbytes doesn't exceed RW_T2T_MAX_LOCK_BYTES during a single loop iteration, the vulnerability can be triggered multiple times during the detection sequence by repeatedly sending a specially crafted response: {0x00, 0x00, 0x01, 0x03, 0x00, 0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00}. This leads to a stack buffer overflow that can overwrite the function pointer p_cback (GitHub Advisory).

If successfully exploited, this vulnerability could allow a remote attacker within NFC range to execute arbitrary code within the context of a privileged process on the target Android device's NFC daemon. This represents a significant security risk as it could lead to complete device compromise (GitHub Advisory, SecurityWeek).

The vulnerability requires physical proximity to the target device (NFC range) and can be exploited by sending specially crafted NFC responses. The proof-of-concept was demonstrated using a Proxmark3 RDV4.01 device against a Pixel3a with build id: QQ1A.191205.011 (GitHub Advisory).

Google addressed this vulnerability in the April 2020 Android Security Patch. Users should ensure their devices are updated to the 2020-04-01 security patch level or newer to protect against this vulnerability (SecurityWeek).