CVE-2022-20461: 
NixOS vulnerability analysis and mitigation

A vulnerability identified as CVE-2022-20461 was discovered in Android's Bluetooth implementation, specifically in the pinReplyNative function of com_android_bluetooth_btservice_AdapterService.cpp. The vulnerability affects Android versions 10, 11, 12, 12L, and 13. This security flaw was disclosed in the January 2023 Android Security Bulletin (Android Bulletin).

The vulnerability is characterized as a type confusion issue leading to an out-of-bounds read in the pinReplyNative function. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-843 (Access of Resource Using Incompatible Type - 'Type Confusion') (NVD Database).

The vulnerability can lead to local escalation of privilege of Bluetooth Low Energy (BLE) functionality. The high CVSS score indicates that successful exploitation could result in significant impacts to confidentiality, integrity, and availability of the affected system (NVD Database).

The vulnerability can be exploited locally with low attack complexity and requires low privileges. No user interaction is needed for exploitation, making it particularly concerning. The vulnerability has been assigned Android ID: A-228602963 (Android Bulletin).

Google has addressed this vulnerability in the January 2023 security patch level. Users of affected Android versions should update their devices to the latest security patch level to mitigate this vulnerability (Android Bulletin).