CVE-2020-0378: 
NixOS vulnerability analysis and mitigation

CVE-2020-0378 is an information disclosure vulnerability in the Android System component that affects Android versions 8.0, 8.1, 9, 10, and 11. The vulnerability was discovered in the onWnmFrameReceived function of PasspointManager.java, where there is a missing permission check that could lead to unauthorized access to location data (Android Bulletin).

The vulnerability stems from a missing permission check in the onWnmFrameReceived function of PasspointManager.java. The flaw requires user execution privileges for exploitation, though no direct user interaction is needed for the exploit to succeed. The vulnerability was addressed as part of Google's October 2020 security update for Android (Threatpost).

If exploited, this vulnerability could lead to local information disclosure of location data. The impact is limited to exposure of location information, but does not require user interaction for exploitation once the attacker has user execution privileges (Android Bulletin).

The vulnerability requires user execution privileges to be exploited, though no direct user interaction is needed once these privileges are obtained. The exploit can be executed locally to access location data (Android Bulletin).

Google addressed this vulnerability in the October 2020 security update for Android. Users should ensure their devices are updated to the latest available security patch level to protect against this vulnerability (Threatpost).