CVE-2021-0333: 
NixOS vulnerability analysis and mitigation

CVE-2021-0333 is a vulnerability discovered in Android's BluetoothPermissionActivity.java component that affects Android versions 8.1 through 11. The vulnerability was disclosed in February 2021 and involves a permissions bypass through a tapjacking overlay that obscures the phonebook permissions dialog during Bluetooth device connection attempts (Android Bulletin).

The vulnerability exists in the onCreate method of BluetoothPermissionActivity.java, where a tapjacking overlay can be used to obscure the phonebook permissions dialog when a Bluetooth device is connecting. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. It is classified under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) (NVD).

If successfully exploited, this vulnerability could lead to local escalation of privilege. The attacker would require user execution privileges, and user interaction is necessary for exploitation. The potential impact includes unauthorized access to phonebook permissions during Bluetooth device connections (Android Bulletin).

The vulnerability requires local access and user interaction for successful exploitation. An attacker needs user execution privileges to initiate the attack. The attack vector involves creating a tapjacking overlay that tricks users into granting permissions without their informed consent (NVD).

The vulnerability was addressed in the February 2021 Android Security Bulletin. Users should update their Android devices to the latest available security patch level to protect against this vulnerability (Android Bulletin).