CVE-2022-20111: 
NixOS vulnerability analysis and mitigation

CVE-2022-20111 is a vulnerability discovered in MediaTek's ion component that was disclosed on May 3, 2022. The vulnerability stems from improper handling of exceptional conditions that could lead to a use-after-free condition. It affects various MediaTek chipsets running Android versions 9.0 through 12.0 (Vendor Advisory).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 base score of 8.4 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The technical root cause is identified as improper handling of exceptional conditions (CWE-755) in the ion component, which can result in a use-after-free condition (NVD).

The vulnerability could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation, making it particularly concerning for affected devices (Vendor Advisory).

MediaTek has released patches for the affected devices and notified device OEMs of the security patches at least two months before the public disclosure. Users should ensure their devices are updated with the latest security patches provided by their device manufacturers (Vendor Advisory).