CVE-2024-20864: 
NixOS vulnerability analysis and mitigation

CVE-2024-20864 is an improper access control vulnerability affecting Samsung's DarManagerService component prior to SMR May-2024 Release 1. The vulnerability was discovered and reported to Samsung Mobile, with the initial CVE record being created on December 5, 2023, and was publicly disclosed on May 7, 2024 (CVE Details).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This scoring indicates that the vulnerability requires local access, low attack complexity, low privileges, and no user interaction, while potentially resulting in high confidentiality impact but no effects on integrity or availability (NVD).

The vulnerability allows local attackers to monitor system resources, potentially compromising the confidentiality of system information. The high confidentiality impact rating suggests that the vulnerability could lead to significant unauthorized access to system resource information (Samsung Mobile).

The vulnerability requires local access to the device and low privileges for exploitation. There are currently no reports of this vulnerability being exploited in the wild (NVD).

Samsung has addressed this vulnerability in the SMR May-2024 Release 1 security update. Users are advised to update their devices to this version or later to mitigate the risk (Samsung Mobile).