CVE-2021-39777: 
NixOS vulnerability analysis and mitigation

In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This vulnerability, identified as CVE-2021-39777, affects Android-12L operating system. The vulnerability was disclosed in the Android Security Bulletin (Android Bulletin).

The vulnerability stems from a missing permission check in the Telephony component of Android. It has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability requires local access with low attack complexity and low privileges, but no user interaction is needed for exploitation (NVD).

This vulnerability could lead to local information disclosure with no additional execution privileges needed. Specifically, it allows an attacker to determine whether certain applications are installed on the device without having the proper query permissions (NVD).

The vulnerability requires local access to the device for exploitation. No user interaction is needed, and the attack complexity is considered low. The attacker needs low privileges to execute the exploit (NVD).

The vulnerability has been addressed in Android-12L. Users should ensure their devices are updated to the latest available version that includes the security patch (Android Bulletin).