CVE-2024-20802: 
NixOS vulnerability analysis and mitigation

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows device owners to access other users' notifications in a multi-user environment. This vulnerability was assigned CVE-2024-20802 and was disclosed in January 2024, affecting Samsung DeX software across multiple Android versions (Samsung Mobile).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) by NIST with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, while Samsung Mobile assessed it with a score of 4.6 (MEDIUM) and vector string CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability specifically relates to improper access control mechanisms in the Samsung DeX environment (NVD).

The vulnerability allows device owners to access notifications belonging to other users in a multi-user environment, potentially exposing sensitive information from other user profiles (CVE).

Samsung has addressed this vulnerability in the SMR Jan-2024 Release 1 update. Users are advised to update their devices to this version or later to mitigate the vulnerability (Samsung Mobile).