CVE-2021-25344: 
NixOS vulnerability analysis and mitigation

Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission. This vulnerability was assigned CVE-2021-25344 and was discovered in January 2021 affecting Android 10.0 and 11.0 devices (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) by NIST with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local access, low attack complexity, low privileges required, no user interaction needed, unchanged scope, high confidentiality impact, but no impact on integrity or availability. Samsung Mobile assigned a slightly higher CVSS score of 6.2 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows attackers to access the device's serial number without proper authorization, representing a confidentiality breach of device information (NVD).

The vulnerability requires local access to the device with low attack complexity. No user interaction is needed for exploitation, though some privilege level is typically needed for local attacks (NVD).

The vulnerability was addressed in the SMR Mar-2021 Release 1 security update from Samsung Mobile (Samsung Mobile).