CVE-2022-20090: 
NixOS vulnerability analysis and mitigation

CVE-2022-20090 is a medium severity vulnerability discovered in the MediaTek aee driver. The vulnerability was disclosed on May 3, 2022, affecting various MediaTek chipsets running Android 11.0 and 12.0 operating systems. The issue is characterized as a missing synchronization vulnerability that could lead to a use-after-free condition due to a race condition (MediaTek Bulletin).

The vulnerability is classified as a Missing Synchronization issue (CWE-820) in the aee driver component. It requires System execution privileges for exploitation and does not require user interaction. The vulnerability affects multiple MediaTek chipsets including MT6580, MT6731, MT6739, and various other models in the MT67xx, MT68xx, and MT87xx series (MediaTek Bulletin).

If exploited, this vulnerability could lead to local escalation of privilege with System execution privileges. The vulnerability specifically affects the aee driver component and could result in a use-after-free condition due to race condition issues (MediaTek Bulletin).

MediaTek has addressed this vulnerability and notified device OEMs of the security patches at least two months before the public disclosure. Users should ensure their devices are updated with the latest security patches provided by their device manufacturers (MediaTek Bulletin).