CVE-2024-20857: 
NixOS vulnerability analysis and mitigation

Improper access control vulnerability in startListening of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to access information of current application. The vulnerability was discovered and reported on May 7, 2024, affecting Samsung Android devices running versions 12.0 and later (Samsung Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) by NIST with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local access required, low attack complexity, low privileges required, no user interaction needed, and potential for high confidentiality impact. Samsung's own assessment assigned a slightly lower CVSS score of 4.0 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows local attackers to access information of the current application, potentially exposing sensitive data. The impact is primarily focused on confidentiality, with no direct impact on integrity or availability of the system (NVD).

The vulnerability requires local access to the device for exploitation. No evidence of active exploitation in the wild has been reported at the time of disclosure (NVD).

Samsung has released a patch in the SMR May-2024 Release 1 update to address this vulnerability. Users are advised to update their devices to the latest security patch level to mitigate the risk (Samsung Advisory).