CVE-2020-0380: 
NixOS vulnerability analysis and mitigation

CVE-2020-0380 is a critical remote code execution vulnerability discovered in the Android System component, specifically in the allocExcessBits function of bitalloc.c. The vulnerability was disclosed in September 2020 and affects Android versions 8.0, 8.1, 9, 10, and 11. The flaw stems from an incorrect bounds check that could lead to an out-of-bounds write condition (Android Bulletin, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw is classified as CWE-787 (Out-of-bounds Write). No user interaction is required for exploitation, and no additional execution privileges are needed to exploit this vulnerability (NVD).

If successfully exploited, this vulnerability could allow a remote attacker to execute arbitrary code within the context of a privileged process. The attack can be performed remotely using a specially crafted transmission, potentially leading to complete system compromise (SecurityWeek, Threatpost).

Google addressed this vulnerability in the September 2020 Android security patch level. Users are advised to update their Android devices immediately to the security patch level 2020-09-01 or later to protect against this vulnerability. Samsung and other Android device manufacturers have also rolled out corresponding security updates to address this flaw (Bleeping Computer).