CVE-2020-0381: 
NixOS vulnerability analysis and mitigation

In the Android Media Framework, CVE-2020-0381 is an information disclosure vulnerability affecting Android versions 8.0, 8.1, 9, and 10. The vulnerability was discovered in Parse_wave of eas_mdls.c, where a possible out of bounds write could occur due to an integer overflow. The issue was disclosed in the September 2020 Android security bulletin (Android Bulletin, Threatpost).

The vulnerability exists in the Parse_wave function of eas_mdls.c component and could lead to remote information disclosure due to an integer overflow resulting in an out of bounds write. The flaw affects Android versions 8.0 through 11 and requires no additional execution privileges or user interaction for exploitation (CVE Mitre).

If exploited, this vulnerability could lead to remote information disclosure in a highly constrained process. The impact is considered high-severity for information disclosure in affected Android versions (Threatpost).

The vulnerability can be exploited remotely without requiring any user interaction or additional execution privileges. No evidence of active exploitation in the wild has been reported (CVE Mitre).

Google addressed this vulnerability as part of the September 2020 Android security updates. Users should update their Android devices to the latest available security patch level to protect against this vulnerability (Android Bulletin).