CVE-2022-21749: 
NixOS vulnerability analysis and mitigation

In telephony systems, a vulnerability (CVE-2022-21749) was discovered that could lead to information disclosure due to a missing permission check. The vulnerability was disclosed in June 2022 and affects MediaTek chipsets running Android 11.0 and 12.0. The issue impacts a wide range of MediaTek chipsets including MT6739, MT6750, MT6761, MT6762, and many others (MediaTek Bulletin).

The vulnerability is classified as a medium severity issue with a CWE-284 (Improper Access Control) designation. The technical root cause is identified as a missing permission check in the telephony component. This security flaw requires no additional execution privileges for exploitation and can be triggered without user interaction (MediaTek Bulletin).

The exploitation of this vulnerability could result in local information disclosure on affected devices. The vulnerability does not require elevated privileges or user interaction to be exploited, making it particularly concerning for device security (MediaTek Bulletin).

MediaTek has addressed this vulnerability and notified device OEMs of the security patches. The fix was included in the June 2022 security update. Users are advised to update their devices to the latest available firmware version that includes these security patches (MediaTek Bulletin).