CVE-2020-0448: 
NixOS vulnerability analysis and mitigation

CVE-2020-0448 is a high severity vulnerability discovered in Android's TelecomServiceImpl.java component affecting Android versions 8.0, 8.1, 9, 10, and 11. The vulnerability was disclosed and patched in November 2020, involving a missing permission check that could allow access to tracking identifiers (Android Bulletin).

The vulnerability exists in the getPhoneAccountsForPackage function of TelecomServiceImpl.java due to a missing permission check. It has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local access, low attack complexity, and high confidentiality impact (NVD).

The vulnerability could lead to local information disclosure of tracking identifiers, which could potentially be used to track an account across different devices. The impact is limited to confidentiality with no effect on integrity or availability (NVD).

The vulnerability requires local access for exploitation, with no additional execution privileges needed. User interaction is not required for exploitation. No known exploits in the wild have been reported (NVD).

The vulnerability was addressed in Android's November 2020 security updates. Users are advised to update their Android devices immediately to the security patch level dated 2020-11-01 or later (Bleeping Computer).