CVE-2023-21501: 
NixOS vulnerability analysis and mitigation

Improper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code. The vulnerability is tracked as CVE-2023-21501 and was discovered in 2022, with patches released in May 2023. The vulnerability affects Samsung Android devices running Android 13.0 and various SMR versions (Samsung Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-20 (Improper Input Validation). The issue affects the mPOS fiserve trustlet component, which is a trusted application running in the secure environment (NVD).

If successfully exploited, this vulnerability allows local attackers to execute arbitrary code with elevated privileges. This could potentially lead to complete compromise of the affected component, with high impacts on confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires local access and low attack complexity to exploit. An attacker needs low privileges but no user interaction to successfully exploit the vulnerability. There are no known public exploits specifically targeting this vulnerability at the time of disclosure (NVD).

Samsung has addressed this vulnerability in the SMR May-2023 Release 1 security update. Users are strongly advised to update their devices to this version or later to protect against potential exploitation (Samsung Advisory).