CVE-2022-21771: 
NixOS vulnerability analysis and mitigation

CVE-2022-21771 is a vulnerability discovered in the GED driver that involves a race condition leading to a possible use-after-free scenario. The vulnerability was disclosed in July 2022 and affects various MediaTek chipsets running Android 11.0 and 12.0 operating systems (Vendor Advisory).

The vulnerability is classified as a race condition (CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization) that could result in a use-after-free condition in the GED driver. It has been assigned a CVSS v3.1 Base Score of 6.7 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could lead to local escalation of privilege with System execution privileges. The exploitation does not require user interaction, though it does require system-level execution privileges (Vendor Advisory).

The vulnerability affects multiple MediaTek chipsets including MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8168, and MT8365. Users should update their devices with the latest security patches provided by MediaTek (Vendor Advisory).