CVE-2021-39747: 
NixOS vulnerability analysis and mitigation

In Settings Provider of Android 12L, there is a possible way to list values of non-readable global settings due to a permissions bypass vulnerability (CVE-2021-39747). This vulnerability allows local information disclosure with no additional execution privileges needed and does not require user interaction for exploitation (Android Security Bulletin).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-276 (Incorrect Default Permissions). The issue affects Android-12L operating system and was tracked internally as Android ID: A-208268457 (NVD).

The vulnerability could lead to local information disclosure of non-readable global settings. An attacker could potentially access sensitive system settings that should be restricted, compromising the system's security model (NVD).

The vulnerability can be exploited locally and requires low privileges. No user interaction is needed for exploitation, making it relatively straightforward to exploit if an attacker has local access to the device (NVD).

The vulnerability has been addressed in Android 12L. Users should ensure their devices are updated to the latest available security patch level that includes fixes for this vulnerability (Android Security Bulletin).