CVE-2024-20836: 
NixOS vulnerability analysis and mitigation

Out of bounds Read vulnerability in ssmis_get_frm in libsubextractor.so prior to SMR Mar-2024 Release 1 allows local attackers to read out of bounds memory. The vulnerability is tracked as CVE-2024-20836 and was discovered in early 2024. The affected systems include Samsung Android devices running versions 11.0 and later that have not been updated to the March 2024 security patch (Samsung Advisory).

The vulnerability is classified as an Out-of-bounds Read (CWE-125) issue in the ssmis_get_frm function within libsubextractor.so library. It has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N by NIST, while Samsung Mobile assessed it with a lower score of 3.3 (LOW) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows local attackers to read out of bounds memory, potentially leading to information disclosure. The attack requires local access to the device but does not require high privileges or special user interaction to exploit (NVD).

The vulnerability requires local access to exploit. While the exact exploitation methods are not publicly disclosed, the attack vector is considered low complexity with low privileges required according to the CVSS scoring (NVD).

Samsung has addressed this vulnerability in the March 2024 Security Maintenance Release (SMR Mar-2024 Release 1). Users should update their devices to the latest available security patch to mitigate this vulnerability (Samsung Advisory).