CVE-2023-33893: 
NixOS vulnerability analysis and mitigation

In fastDial service, there is a missing permission check vulnerability (CVE-2023-33893) that could lead to local information disclosure with no additional execution privileges needed. The vulnerability affects Google Android versions 10.0, 11.0, 12.0, and 13.0, as well as various Unisoc hardware models including S8002, SC7731E, SC9832E, SC9863A, and T310 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-862: Missing Authorization, indicating a failure to properly check permissions before allowing access to sensitive information (NVD).

The vulnerability allows local information disclosure without requiring additional execution privileges. This means an attacker with local access could potentially access sensitive information that should be restricted (NVD).

The vulnerability requires local access and low privileges to exploit. No user interaction is needed for exploitation, making it relatively straightforward to exploit if an attacker has the required local access (NVD).

Unisoc has released an advisory regarding this vulnerability. Users should check with their device manufacturers for available security updates and apply them as soon as possible (Unisoc Advisory).