CVE-2021-0898: 
NixOS vulnerability analysis and mitigation

CVE-2021-0898 is a use-after-free vulnerability discovered in the apusys component of MediaTek chipsets. The vulnerability was disclosed in December 2021 and affects various MediaTek chipset models including MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, and MT8797, running Android versions 10.0, 11.0, and 12.0 (MediaTek Bulletin).

The vulnerability is classified as a Use After Free (CWE-416) issue that could lead to memory corruption in the apusys component. It has been assigned a CVSS v3.1 Base Score of 6.7 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating local access vector, low attack complexity, high privileges required, and no user interaction needed (NVD).

If exploited, this vulnerability could result in local escalation of privilege with System execution privileges. The potential memory corruption due to use-after-free condition could allow an attacker to elevate their privileges on the affected system (MediaTek Bulletin).

The vulnerability requires System execution privileges for exploitation, and user interaction is not needed. The local attack vector means the attacker needs local access to the device to exploit the vulnerability (MediaTek Bulletin).

MediaTek has addressed this vulnerability and notified device OEMs of the security patches at least two months before publication. The fix was included in the December 2021 security bulletin (MediaTek Bulletin).