CVE-2023-20950: 
NixOS vulnerability analysis and mitigation

In AlarmManagerActivity of AlarmManagerActivity.java, there exists a vulnerability (CVE-2023-20950) that could allow bypassing background activity launch restrictions through a pendingIntent. The vulnerability affects Android versions 11, 12, and 12L. This security issue was disclosed in the April 2023 Android Security Bulletin (Android Bulletin).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue is classified under CWE-863 (Incorrect Authorization). The vulnerability exists in the AlarmManagerActivity component and involves improper handling of pendingIntent that could lead to bypassing background activity launch restrictions (NVD).

A successful exploitation of this vulnerability could lead to local escalation of privilege with no additional execution privileges needed. The impact is significant as it affects confidentiality, integrity, and availability, all rated as High in the CVSS scoring. No user interaction is required for exploitation (NVD).

Google has addressed this vulnerability in the April 2023 Android Security Bulletin. Users should update their Android devices to the latest security patch level to mitigate this vulnerability (Android Bulletin).