CVE-2023-21081: 
NixOS vulnerability analysis and mitigation

CVE-2023-21081 is a vulnerability discovered in Android's PackageInstallerService.java and related files. The vulnerability affects Android versions 11, 12, 12L, and 13. It was disclosed in April 2023 and involves a possible way to bypass background activity launch restrictions due to a logic error in the code (Android Bulletin).

The vulnerability stems from a logic error in multiple functions of PackageInstallerService.java that could allow bypassing background activity launch restrictions. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access required with low attack complexity (NVD).

A successful exploitation of this vulnerability could lead to local escalation of privilege with high impacts on confidentiality, integrity, and availability. The vulnerability requires no additional execution privileges and can be exploited without user interaction (NVD).

Google has addressed this vulnerability in the Android Security Bulletin for April 2023. Users should update their Android devices to a security patch level of April 5, 2023, or later to receive the fix (Android Bulletin).