CVE-2023-42570: 
NixOS vulnerability analysis and mitigation

An improper access control vulnerability was discovered in KnoxCustomManagerService affecting Samsung mobile devices running Android versions 11, 12, 13, and 14. The vulnerability (CVE-2023-42570) was reported privately on September 22, 2023, and was addressed in Samsung's December 2023 Security Maintenance Release (SMR) (Samsung Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (LOW) by NIST with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, while Samsung Mobile assessed it with a score of 5.9 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The vulnerability requires local access to exploit and has low attack complexity (NVD).

If exploited, the vulnerability allows an attacker to access the device's SIM PIN, potentially compromising the confidentiality of sensitive SIM card information (Samsung Advisory).

Samsung addressed this vulnerability by adding proper access control in the SMR Dec-2023 Release 1. Users are advised to update their devices to the latest security patch level to receive the fix (Samsung Advisory).