CVE-2020-0497: 
NixOS vulnerability analysis and mitigation

In Android 11, a vulnerability identified as CVE-2020-0497 was discovered in the BiometricServiceBase component. The vulnerability was disclosed in the December 2020 Android security bulletin. This security flaw affects the canUseBiometric functionality, where a missing permission check could potentially expose sensitive information (Android Bulletin).

The vulnerability stems from a missing authorization check in the canUseBiometric function of BiometricServiceBase. The severity of this vulnerability has been assessed with a CVSS v3.1 Base Score of 5.5 (Medium), with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Under CVSS v2.0, it received a Base Score of 2.1 (Low) with the vector: AV:L/AC:L/Au:N/C:P/I:N/A:N (NVD).

The vulnerability could lead to local information disclosure without requiring additional execution privileges. The impact is primarily focused on confidentiality, with no direct impact on system integrity or availability. The high confidentiality impact rating in the CVSS score indicates that sensitive biometric-related information could potentially be exposed (NVD).

The vulnerability can be exploited locally and requires low attack complexity. No user interaction is needed for exploitation, though local access and low privileges are required. The attack vector is local (AV:L), indicating that the attacker needs local access to the vulnerable system (NVD).

The vulnerability was addressed in the Android security bulletin for December 2020. Users should ensure their Android devices are updated with the latest security patches to mitigate this vulnerability (Android Bulletin).