CVE-2024-20895: 
NixOS vulnerability analysis and mitigation

Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features. This vulnerability is tracked as CVE-2024-20895 and was initially reported to Samsung Mobile. The vulnerability affects Samsung Android devices running versions 12.0 and later (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.7 (High) by Samsung Mobile with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, while NVD assigned a score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The vulnerability specifically affects the Dar service component and involves improper access control mechanisms that could be exploited by local attackers (NVD).

The vulnerability allows local attackers to bypass restrictions specifically related to calling SDP (Samsung Device Protection) features. This could potentially lead to unauthorized access to protected features and compromise the security model of affected devices (NVD).

The vulnerability requires local access to the device for exploitation. The attack complexity is considered low, and no user interaction is required according to the CVSS metrics. However, there are no public reports of this vulnerability being exploited in the wild (NVD).

Samsung has addressed this vulnerability in the SMR Jul-2024 Release 1 security update. Users of affected devices should update their systems to this version or later to mitigate the vulnerability (Samsung Mobile).