CVE-2024-20874: 
NixOS vulnerability analysis and mitigation

CVE-2024-20874 is an improper access control vulnerability affecting SmartManagerCN in Samsung mobile devices prior to SMR Jun-2024 Release 1. The vulnerability was discovered and reported to Samsung Mobile on June 4, 2024, and allows local attackers to launch privileged activities (Samsung Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) by NIST with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, low privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. Samsung Mobile assigned a slightly different CVSS score of 7.9 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L (NVD).

If exploited, this vulnerability allows local attackers to execute privileged activities on affected Samsung devices, potentially compromising system security and gaining unauthorized access to protected functionality (Samsung Advisory).

The vulnerability requires local access to the device for exploitation. No evidence of active exploitation in the wild has been reported at the time of disclosure (NVD).

Samsung has addressed this vulnerability in the SMR Jun-2024 Release 1 security update. Users of affected devices should update their software to this version or later to mitigate the risk (Samsung Advisory).