CVE-2023-42685: 
NixOS vulnerability analysis and mitigation

In wifi service, there is a possible missing permission check that could lead to local escalation of privilege with no additional execution privileges needed. This vulnerability (CVE-2023-42685) affects Google Android 10.0 and various UNISOC chipsets including S8000, SC7731E, SC9832E, SC9863A, T310, T606, T610, T612, and T616. The vulnerability was disclosed in December 2023 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability stems from a missing permission check in the wifi service component, which could allow unauthorized access to privileged functionality (NVD).

If exploited, this vulnerability allows a local attacker to escalate privileges on the affected device. The high CVSS score indicates that successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected component (NVD).

The vulnerability has been addressed in the December 2023 security updates. Users of affected devices should ensure they install the latest security patches available for their devices (CISA Bulletin).