CVE-2020-0148: 
NixOS vulnerability analysis and mitigation

CVE-2020-0148 is a vulnerability discovered in Android 10's Bluetooth implementation, specifically in the functions btu_hcif_pin_code_request_evt, btu_hcif_link_key_request_evt, and btu_hcif_link_key_notification_evt of btu_hcif.cc. The vulnerability was disclosed and patched in June 2020, affecting Android 10 operating systems (Android Bulletin).

The vulnerability is classified as an out-of-bounds read vulnerability (CWE-125) due to a missing bounds check in the Bluetooth implementation. The CVSS 3.1 base score is 4.4 (Medium) with a vector string of CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating local access requirements with high privileges needed (NVD).

The vulnerability could lead to local information disclosure through compromised device firmware. The impact is primarily focused on confidentiality, with the potential for exposing sensitive system information when successfully exploited (NVD).

The vulnerability requires system execution privileges for exploitation, and no user interaction is needed. The attack complexity is low, but it requires local access and high privileges to execute (NVD).

Google addressed this vulnerability in the Android Security Bulletin for June 2020. Users should update their Android devices to the latest available security patch level to mitigate this vulnerability (Android Bulletin).