CVE-2022-20091: 
NixOS vulnerability analysis and mitigation

CVE-2022-20091 is a vulnerability discovered in the aee driver that involves a race condition leading to a potential use-after-free scenario. The vulnerability was disclosed in May 2022 and affects various MediaTek chipsets running Android versions 11.0 and 12.0. This security flaw requires system execution privileges for exploitation and does not require user interaction (MediaTek Bulletin).

The vulnerability is classified as a race condition (CWE-362) in the aee driver component, which can result in a use-after-free condition. It has been assigned a medium severity rating. The vulnerability specifically affects system-level operations and requires system execution privileges to exploit (MediaTek Bulletin).

If successfully exploited, this vulnerability could lead to local escalation of privilege with System execution privileges. The vulnerability affects a wide range of MediaTek chipsets, including MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, and many others (MediaTek Bulletin).

MediaTek has addressed this vulnerability through software updates. The fix was included in Android versions 11.0 and 12.0 updates for affected devices. No specific workarounds were provided, making it essential to apply the security updates (MediaTek Bulletin).