CVE-2021-1040: 
NixOS vulnerability analysis and mitigation

In the BluetoothPairingSelectionFragment.java onCreate method, a vulnerability was discovered that could lead to local escalation of privilege (EoP) through a tapjacking/overlay attack. The vulnerability affects Android versions 9, 10, 11, and 12, and is tracked as CVE-2021-1040. The issue was disclosed in the Android Security Bulletin for December 2021 (Android Bulletin).

The vulnerability exists in the onCreate method of BluetoothPairingSelectionFragment.java and can be exploited through a tapjacking or overlay attack. No additional execution privileges are required for exploitation, though user interaction is necessary. The vulnerability was assigned Android ID A-182810085 (CVE Details).

If successfully exploited, this vulnerability could lead to local escalation of privilege on affected Android devices. The attack requires user interaction but could potentially allow an attacker to gain elevated privileges on the system (CVE Details).

The vulnerability has been addressed in the Android Security Bulletin for December 2021. Users should ensure their devices are updated with the latest security patches (Android Bulletin).