CVE-2020-0391: 
NixOS vulnerability analysis and mitigation

In Android's PackageManagerService.java, a vulnerability was discovered in the applyPolicy function that could allow arbitrary command execution with System privileges. The vulnerability affects Android versions 9, 10, and 11, and was assigned identifier CVE-2020-0391. The issue stems from an unenforced protected-broadcast mechanism (Threatpost, CVE).

The vulnerability is classified as an elevation of privilege issue in the Android Framework component. The flaw exists due to an unenforced protected-broadcast in the applyPolicy function of PackageManagerService.java. The vulnerability requires no additional execution privileges for exploitation and can be triggered without user interaction (CVE).

If successfully exploited, this vulnerability could lead to local escalation of privilege, allowing an attacker to execute arbitrary commands with System level privileges. This represents a significant security risk as it could allow malicious actors to gain elevated access to system resources (CVE).

The vulnerability requires local access to the device for exploitation. No additional execution privileges are needed, and user interaction is not required for exploitation, making it relatively straightforward to exploit for an attacker with local access (CVE).

Google addressed this vulnerability in the September 2020 Android security updates. Users are advised to update their Android devices to the latest available security patch level to protect against this vulnerability (Android Bulletin).