CVE-2020-27098: 
NixOS vulnerability analysis and mitigation

In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible permissions bypass vulnerability in Android 11 that could lead to local information disclosure. The vulnerability (CVE-2020-27098) allows unauthorized access to contacts without requiring additional execution privileges or user interaction (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates a local attack vector, low attack complexity, low privileges required, no user interaction needed, and high confidentiality impact without affecting integrity or availability (NVD).

The successful exploitation of this vulnerability could lead to unauthorized access to contacts information, resulting in local information disclosure. The impact is limited to confidentiality breaches without affecting system integrity or availability (NVD).

The vulnerability requires local access to the device but does not need additional execution privileges or user interaction for exploitation. The attack complexity is considered low, making it relatively straightforward to exploit once local access is obtained (NVD).

The vulnerability has been addressed in Android 11 security updates. Users should ensure their devices are updated with the latest security patches to mitigate this vulnerability (Android Security Bulletin).