CVE-2022-20074: 
NixOS vulnerability analysis and mitigation

CVE-2022-20074 is a medium severity vulnerability discovered in MediaTek's preloader (partition) component. The vulnerability was disclosed in April 2022 and affects various MediaTek chipsets including MT6761, MT6762, MT6763, MT6765, and several others. The issue stems from a missing bounds check that could potentially lead to an out-of-bounds write (MediaTek Bulletin).

The vulnerability is classified as an Out-of-bounds Read (CWE-125) that exists in the preloader partition component. The issue occurs due to a missing bounds check in the implementation, which could potentially lead to an out-of-bounds write operation. The vulnerability has been assigned a medium severity rating (MediaTek Bulletin).

If exploited, this vulnerability could lead to local escalation of privilege. The impact is limited to scenarios where an attacker has physical access to the device. No additional execution privileges are required for exploitation, though user interaction is necessary (MediaTek Bulletin).

MediaTek has addressed this vulnerability and notified device OEMs of the security patches. The fix was included in the April 2022 security update. Device manufacturers were notified of the issues and corresponding security patches at least two months before publication (MediaTek Bulletin).