CVE-2022-20087: 
NixOS vulnerability analysis and mitigation

CVE-2022-20087 is a medium severity vulnerability discovered in MediaTek's CCU (Camera Control Unit) component. The vulnerability was disclosed on May 3, 2022, affecting various MediaTek chipsets running Android 11.0 and 12.0. The issue stems from improper input validation that could lead to an out-of-bounds write condition (MediaTek Bulletin).

The vulnerability is classified as an improper input validation issue (CWE-20) that results in a potential out-of-bounds write due to a missing bounds check. It has been assigned a CVSS v3.1 Base Score of 6.7 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) (NVD).

If exploited, this vulnerability could lead to local escalation of privilege with System execution privileges needed. The attack requires local access but does not need user interaction for exploitation (MediaTek Bulletin).

The vulnerability affects MediaTek chipsets MT6833, MT6853, MT6873, MT6877, MT6885, and MT6893 running Android versions 11.0 and 12.0. MediaTek has released patches to address this vulnerability, and device manufacturers have been notified of the security patches at least two months before publication (MediaTek Bulletin).