CVE-2024-20865: 
NixOS vulnerability analysis and mitigation

Authentication bypass vulnerability (CVE-2024-20865) was discovered in Samsung bootloader prior to SMR May-2024 Release 1. The vulnerability allows physical attackers to flash arbitrary images onto affected devices (Samsung Advisory). The issue affects Samsung Android devices running versions 12.0, 13.0, and 14.0.

The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium) with the vector string CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H by NIST NVD, indicating physical access is required but no privileges or user interaction is needed to exploit. Samsung's assessment gives it a slightly lower score of 6.6 with vector CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, suggesting user interaction is required (NVD).

If exploited, this vulnerability allows attackers with physical access to the device to flash arbitrary images onto the device, potentially leading to complete compromise of device security and unauthorized code execution (Samsung Advisory).

The vulnerability requires physical access to the device to exploit. No remote attack vector has been identified. No public exploits are known to exist at the time of disclosure (NVD).

Samsung has addressed this vulnerability in the SMR May-2024 Release 1 security update. Users are advised to update their devices to the latest available security patch level to protect against this vulnerability (Samsung Advisory).