CVE-2023-40085: 
NixOS vulnerability analysis and mitigation

CVE-2023-40085 is a vulnerability discovered in the Android Neural Networks module, specifically in the convertSubgraphFromHAL function of ShimConverter.cpp. The vulnerability was disclosed in February 2024 and affects Android versions 12.0, 12.1, and 13.0. This out-of-bounds read vulnerability occurs due to a missing bounds check (NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) with a CVSS v3.1 base score of 5.5 (Medium) according to NVD's assessment. The attack vector is local (AV:L), with low attack complexity (AC:L), requiring low privileges (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), with high confidentiality impact (C:H) but no impact on integrity (I:N) or availability (A:N) (NVD).

The vulnerability could lead to local information disclosure with no additional execution privileges needed. The primary security impact is the potential exposure of sensitive information through the out-of-bounds read operation (NVD).

The vulnerability has been addressed in the Android January 2024 Security Bulletin. Users should update their Android devices to the latest available security patch level (Android Security Bulletin).