CVE-2024-20802: 
NixOS vulnerability analysis and mitigation

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows device owners to access other users' notifications in a multi-user environment. This vulnerability was assigned CVE-2024-20802 and was disclosed in January 2024, affecting Samsung DeX software across multiple Android versions (Samsung Mobile).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) by NIST with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, while Samsung Mobile assessed it with a score of 4.6 (MEDIUM) and vector string CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability specifically relates to improper access control mechanisms in the Samsung DeX environment (NVD).

The vulnerability allows device owners to access notifications belonging to other users in a multi-user environment, potentially exposing sensitive information from other user profiles (CVE).

The vulnerability requires local access to the device and can be exploited by the device owner to access other users' notifications. No public exploits have been reported at the time of disclosure (NVD).

Samsung has addressed this vulnerability in the SMR Jan-2024 Release 1 update. Users are advised to update their devices to this version or later to mitigate the vulnerability (Samsung Mobile).