CVE-2023-21138: 
NixOS vulnerability analysis and mitigation

In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation. This vulnerability (CVE-2023-21138) affects Android versions 11, 12, 12L, and 13. The issue requires user execution privileges but does not need user interaction for exploitation (Android Bulletin).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability stems from improper input validation (CWE-20) and incorrect default permissions (CWE-276) in the CallRedirectionProcessor.java component (NVD).

A successful exploitation of this vulnerability could lead to local escalation of privilege and unauthorized background activity launches. The vulnerability affects confidentiality, integrity, and availability of the system, with potential for high impact across all three security metrics (NVD).

The vulnerability requires local access and user execution privileges for exploitation. However, no user interaction is needed once these conditions are met, making it relatively straightforward to exploit if the attacker has the necessary access level (Android Bulletin).

The vulnerability was addressed in the June 2023 Android Security Bulletin. Users should update their Android devices to the latest available security patch level to mitigate this vulnerability (Android Bulletin).