CVE-2024-0024: 
NixOS vulnerability analysis and mitigation

CVE-2024-0024 is a vulnerability in multiple methods of UserManagerService.java in Android OS that could lead to a failure to persist or enforce user restrictions due to improper input validation. The vulnerability was discovered and reported to Google, with a patch being released in the May 2024 Android Security Bulletin (Android Bulletin).

The vulnerability is classified as a High severity Elevation of Privilege (EoP) issue affecting Android versions 12, 12L, 13, and 14. The vulnerability allows creating users with no restrictions by exploiting an IOException that occurs when putting extras that are too long to be serialized in an intent to create a user, preventing the restrictions from being written to the file (Android Source).

If exploited, this vulnerability could allow a malicious actor to create user accounts without proper restrictions, potentially leading to unauthorized privilege escalation on affected Android devices (Android Bulletin).

The vulnerability requires local access to exploit and no additional execution privileges are needed. The issue was addressed by truncating string values when writing them to the file to ensure that the restrictions are recorded correctly (Android Source).

The vulnerability has been patched in the May 2024 Android Security Bulletin. Users should update their Android devices to a security patch level of 2024-05-01 or later to address this issue (Android Bulletin).