CVE-2020-25053: 
NixOS vulnerability analysis and mitigation

An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary code execution. The Samsung ID is SVE-2020-17435 (August 2020) (NVD, CISA).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a Base Score of 7.5 HIGH with vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P) (NVD).

The vulnerability allows attackers to execute arbitrary code on affected Samsung mobile devices running Android 10.0 with exynos9830 chipsets. Given the CRITICAL severity rating and complete compromise of confidentiality, integrity and availability indicated by the CVSS scores, successful exploitation could result in full system compromise (NVD).

The vulnerability requires no privileges (PR:N) or user interaction (UI:N) and can be exploited with low attack complexity (AC:L) over the network (AV:N), making it relatively straightforward to exploit (NVD).

Samsung has addressed this vulnerability in their August 2020 security update. Users of affected devices should ensure they have installed the latest security patches (Samsung Mobile).