CVE-2020-0468: 
NixOS vulnerability analysis and mitigation

CVE-2020-0468 is a vulnerability discovered in Android's TelephonyRegistry.java component affecting Android versions 10 and 11. The vulnerability involves a possible permissions bypass of location permissions due to a missing permission check in the listen() and related functions (Android Security Bulletin).

The vulnerability stems from a missing permission check in TelephonyRegistry.java's listen() and related functions. It has been assigned a CVSS 3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local access required with low attack complexity and no user interaction needed (NVD).

If exploited, this vulnerability could lead to local information disclosure of location data without requiring additional execution privileges. The impact is primarily focused on unauthorized access to location information, potentially compromising user privacy (Android Security Bulletin).

The vulnerability requires local access to exploit, with no additional execution privileges needed. No user interaction is required for exploitation, making it relatively straightforward to exploit if an attacker has local access to the device (NVD).

The vulnerability was addressed in the December 2020 Android Security Bulletin. Users should update their Android devices to the latest available security patch level to protect against this vulnerability (Android Security Bulletin).