CVE-2021-41094: 
NixOS vulnerability analysis and mitigation

Wire, an open source secure messenger, was found to have a vulnerability (CVE-2021-41094) where users could bypass the mandatory encryption at rest feature. The issue was discovered in Wire by Bund implementation, where users could circumvent the security measure by simply disabling their device passcode. The vulnerability was disclosed on September 15, 2021, and affected versions prior to 3.70 (CVE Details).

When launching the app, it attempts to enable encryption at rest by generating encryption keys via the Secure Enclave. However, if no device passcode is set, this process fails silently. The critical security flaw lies in the fact that users receive no indication that encryption at rest is not active, as this feature is hidden from their view (CVE Details).

The vulnerability compromises the confidentiality of user data by potentially leaving it unencrypted at rest. Since Wire is marketed as a secure messenger, this silent failure of encryption implementation could expose sensitive user data to unauthorized access if the device falls into the wrong hands (CVE Details).

The vulnerability has been resolved in Wire version 3.70. The fix includes implementing proper user notification when encryption at rest cannot be enabled due to missing device passcode, and ensuring users are aware of the security implications (GitHub Commit).