CVE-2020-27056: 
NixOS vulnerability analysis and mitigation

In SELinux policies of mls, there is a missing permission check in Android 11. This vulnerability (CVE-2020-27056) was discovered and disclosed in December 2020. The issue could lead to local information disclosure of package metadata with no additional execution privileges needed. User interaction is not needed for exploitation (Android Bulletin).

The vulnerability has been assigned a CVSS v3.1 Base Score of 3.3 (LOW) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-862 (Missing Authorization). The issue affects Android 11 operating system and is related to missing permission checks in SELinux policies (NVD).

The vulnerability allows local attackers to access package metadata information that should be restricted. The impact is limited to information disclosure with no ability to modify or execute code (NVD).

The vulnerability can be exploited locally and requires low complexity with no user interaction. The attacker needs low privileges to exploit this vulnerability. No known exploits were identified in the wild at the time of disclosure (NVD).

The vulnerability was addressed in the Android Security Bulletin for December 2020. Users should update their Android devices to the latest security patch level to mitigate this vulnerability (Android Bulletin).