CVE-2022-20559: 
NixOS vulnerability analysis and mitigation

A vulnerability was identified in Android 13's PermissionManager.java component, specifically in the revokeOwnPermissionsOnKill function. The vulnerability (CVE-2022-20559) allows for side channel information disclosure that could enable an attacker to determine whether an app is installed without having query permissions. This vulnerability was disclosed in December 2022 and affects Android 13 systems (NVD).

The vulnerability exists in the revokeOwnPermissionsOnKill function of PermissionManager.java. It has been assigned a CVSS v3.1 base score of 3.3 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-203 (Observable Discrepancy), indicating it relates to information exposure through observable discrepancies in system behavior (NVD).

The vulnerability allows for local information disclosure without requiring additional execution privileges. An attacker could potentially determine whether specific applications are installed on the device without having the necessary query permissions, representing a privacy concern for Android users (NVD).

Google has addressed this vulnerability in the Android Security Bulletin for December 2022. Users should ensure their Android 13 devices are updated with the latest security patches to mitigate this vulnerability (Pixel Update Bulletin).