CVE-2024-20835: 
NixOS vulnerability analysis and mitigation

Improper access control vulnerability in CustomFrequencyManagerService prior to SMR Mar-2024 Release 1 allows local attackers to execute privileged behaviors (NVD, CVE). The vulnerability was discovered and disclosed on March 5, 2024, affecting Samsung Android devices running Android versions prior to the March 2024 security update.

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 HIGH by NIST with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Samsung Mobile assigned it a score of 4.0 MEDIUM with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

Successful exploitation of this vulnerability could allow local attackers to execute privileged behaviors on affected Samsung devices. The high CVSS score indicates potential for significant impact on confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires local access to the device for exploitation. The attack complexity is low and requires low privileges, with no user interaction needed for exploitation (NVD).

Samsung has released a security patch in the March 2024 Security Maintenance Release (SMR Mar-2024 Release 1) to address this vulnerability. Users are advised to update their devices to the latest security patch level (Samsung Mobile Security).