CVE-2023-42697: 
NixOS vulnerability analysis and mitigation

In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. The vulnerability affects Google Android versions 11.0, 12.0, and 13.0, as well as various Unisoc hardware platforms including S8000, SC7731E, SC9832E, SC9863A, T310, and T606 (NVD).

The vulnerability has been assigned CVE-2023-42697 and has a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue stems from a missing authorization check (CWE-862) in the omacp service, which allows unauthorized access to permission usage records (NVD).

The vulnerability allows local information disclosure without requiring additional execution privileges. This means an attacker with local access could potentially access sensitive permission usage records of applications, compromising the confidentiality of system data (NVD).

The vulnerability has been acknowledged and tracked in the Android security system. Users should ensure their devices are updated with the latest security patches provided by their device manufacturers (NVD).