CVE-2024-31312: 
NixOS vulnerability analysis and mitigation

A vulnerability identified as CVE-2024-31312 affects multiple locations in Android operating systems. The vulnerability was discovered and reported to Android (associated with Google Inc. or Open Handset Alliance), with the disclosure made public in June 2024. This security issue affects Android versions 12.0, 12.1, 13.0, and 14.0 (NVD).

The vulnerability is characterized as an information leak due to a missing permission check. It has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is associated with CWE-276 (Incorrect Default Permissions) (NVD).

When exploited, this vulnerability can lead to local information disclosure, specifically exposing played media content. The impact is limited to confidentiality, with no effect on system integrity or availability (NVD).

The vulnerability requires local access with low complexity and low privileges for exploitation. No user interaction is needed for exploitation, making it relatively straightforward to exploit once local access is obtained (NVD).

A patch has been released to address this vulnerability. The fix involves updating the media visibility on lock screen to follow the notification setting, ensuring that if notifications are disabled on the lock screen, the media carousel is hidden everywhere, not just in the keyguard layout (Android Git).