CVE-2020-0385: 
NixOS vulnerability analysis and mitigation

CVE-2020-0385 is a high-severity information disclosure vulnerability affecting Android's Media Framework component. The vulnerability was discovered in Parse_insh of eas_mdls.c and is caused by an incorrect bounds check that could lead to an out-of-bounds write. This vulnerability affects multiple Android versions including Android 8.0, 8.1, 9, 10, and 11. The issue was officially disclosed and patched in the September 2020 Android security updates (Android Bulletin).

The vulnerability exists in the Parse_insh function of eas_mdls.c file within Android's Media Framework. It received a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-787 (Out-of-bounds Write) and requires user interaction for exploitation (NVD).

If successfully exploited, this vulnerability could lead to remote information disclosure in the media extractor. The attack requires no additional execution privileges but does need user interaction to be successful. The vulnerability primarily affects the confidentiality of the system, with high potential for information disclosure (NVD).

The vulnerability requires user interaction for exploitation, suggesting that an attacker would need to convince a user to interact with a malicious file or application. The local attack vector (AV:L) indicates that the attacker needs local access to the vulnerable component (NVD).

Google addressed this vulnerability in the September 2020 Android security bulletin. Users should update their Android devices to the latest available security patch level to protect against this vulnerability (Android Bulletin).

The vulnerability was part of Google's September 2020 Android security updates, which addressed a total of 53 CVEs. It was classified as one of several high-severity information disclosure flaws in the Android Media Framework (Threatpost).