CVE-2021-0952: 
NixOS vulnerability analysis and mitigation

CVE-2021-0952 is a vulnerability discovered in Android's PhotoSelectionHandler.java component, specifically in the doCropPhoto functionality. The vulnerability was disclosed in the December 2021 Android Security Bulletin and affects multiple Android versions including Android 9, 10, 11, and 12. This security issue was assigned Android ID A-195748381 (Android Bulletin).

The vulnerability is classified as a confused deputy issue that could lead to a permission bypass. It received a CVSS v3.1 Base Score of 5.0 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. The scoring indicates that the vulnerability requires local access, low attack complexity, low privileges, and user interaction for exploitation (NVD).

If exploited, this vulnerability could result in local information disclosure of user's contacts. The impact is limited to confidentiality (High), with no impact on integrity or availability of the system. The vulnerability requires no additional execution privileges for exploitation (CVE).

The vulnerability requires user interaction for successful exploitation. The attack requires local access to the device, making it less severe than remotely exploitable vulnerabilities. The attacker needs low privileges to execute the attack (NVD).

The vulnerability was addressed in the Android Security Bulletin of December 2021. Users should ensure their Android devices are updated to the latest security patch level to mitigate this vulnerability (Android Bulletin).