CVE-2024-20830: 
NixOS vulnerability analysis and mitigation

Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock settings. The vulnerability is tracked as CVE-2024-20830 and was discovered in early 2024. The issue affects Samsung mobile devices running Android operating systems. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) (Samsung Advisory).

The vulnerability has been classified as CWE-276 (Incorrect Default Permissions). The CVSS v3.1 vector string is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating that the vulnerability requires local access, low attack complexity, low privileges, and no user interaction. The scope is unchanged, with low impact on confidentiality, integrity, and availability (NVD).

The vulnerability allows local attackers to configure AppLock settings, potentially compromising the security of protected applications. The impact is rated as low across confidentiality, integrity, and availability, suggesting limited but notable security implications (Samsung Advisory).

The vulnerability requires local access to the device and low privileges for exploitation. No user interaction is needed, making it relatively straightforward to exploit for an attacker with local access (NVD).

Samsung has addressed this vulnerability in the SMR MAr-2024 Release 1 security update. Users are advised to update their devices to the latest security patch level to mitigate this vulnerability (Samsung Advisory).