CVE-2022-20116: 
NixOS vulnerability analysis and mitigation

A vulnerability was identified in Android's OngoingCallController.kt component, specifically in the onEntryUpdated function. This security flaw, tracked as CVE-2022-20116, affects Android versions 12 and 12L. The vulnerability was discovered and reported to Google, with the official disclosure occurring in the May 2022 Android Security Bulletin (Android Bulletin).

The vulnerability exists in the onEntryUpdated function of OngoingCallController.kt, where it becomes possible to launch non-exported activities due to intent redirection. This implementation flaw could be exploited with user execution privileges, though notably, no user interaction is required for successful exploitation (CVE Details).

The vulnerability allows for local escalation of privilege on affected Android devices. The impact is particularly concerning as it requires minimal user interaction for exploitation, potentially allowing malicious applications to gain elevated privileges on the system (Android Bulletin).

Google addressed this vulnerability in the May 2022 Android Security Bulletin. Users of affected Android versions (12 and 12L) should apply the security patch level dated 2022-05-01 or later to protect their devices (Android Bulletin).