CVE-2022-20101: 
NixOS vulnerability analysis and mitigation

CVE-2022-20101 is a medium severity vulnerability discovered in the aee daemon component that was disclosed on May 3, 2022. The vulnerability is classified as a path traversal issue (CWE-22) that could allow local information disclosure without requiring additional execution privileges or user interaction (MediaTek Bulletin).

The vulnerability exists due to improper limitation of a pathname to a restricted directory (path traversal) in the aee daemon component. This vulnerability has a medium severity rating and affects Android versions 11.0 and 12.0 running on various MediaTek chipsets including MT6580, MT6739, MT6761, MT6762, MT6765 and several others (MediaTek Bulletin).

If exploited, this vulnerability could lead to local information disclosure on affected devices. The attack can be executed locally without requiring additional execution privileges or user interaction (MediaTek Bulletin).

The vulnerability can be exploited locally without requiring additional execution privileges. No user interaction is needed for exploitation (MediaTek Bulletin).

MediaTek has released patches for this vulnerability. Device manufacturers were notified of the issue and corresponding security patches at least two months before public disclosure. Users should ensure their devices are updated with the latest security patches (MediaTek Bulletin).