CVE-2022-20489: 
NixOS vulnerability analysis and mitigation

CVE-2022-20489 is a vulnerability discovered in Android's AutomaticZenRule.java component affecting Android versions 10, 11, 12, 12L, and 13. The vulnerability involves a possible failure to persist permissions settings due to resource exhaustion. This issue was addressed in the January 2023 Android Security Bulletin (Android Bulletin).

The vulnerability exists in many functions of AutomaticZenRule.java where resource exhaustion can lead to a failure in persisting permissions settings. The issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) (NVD).

If exploited, this vulnerability could lead to local escalation of privilege on affected Android devices. The successful exploitation does not require any additional execution privileges or user interaction (CVE Details).

The vulnerability can be exploited locally and requires low complexity with low privileges. No user interaction is needed for exploitation, making it relatively straightforward to exploit for an attacker with local access to the device (NVD).

The vulnerability was addressed in the January 2023 Android Security Bulletin. Users should update their Android devices to the latest available security patch level to mitigate this vulnerability (Android Bulletin).