CVE-2022-26474: 
NixOS vulnerability analysis and mitigation

In sensorhub, there is a possible out of bounds write vulnerability (CVE-2022-26474) discovered in MediaTek chipsets. The vulnerability was disclosed on October 7, 2022 and affects Android 12.0 running on various MediaTek chipsets including MT6789, MT6855, MT6879, MT6895, and MT6983 (Vendor Advisory).

The vulnerability is caused by an incorrect calculation of buffer size in the sensorhub component, which could lead to an out of bounds write condition. It has been assigned CWE-131 (Incorrect Calculation of Buffer Size) and received a CVSS v3.1 Base Score of 6.7 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) (NVD).

A successful exploitation of this vulnerability could lead to local escalation of privilege with System execution privileges needed. The vulnerability requires no user interaction for exploitation (Vendor Advisory).

MediaTek has addressed this vulnerability by releasing security patches. Device OEMs were notified of the issues and corresponding security patches at least two months before public disclosure. Users should ensure their devices are updated with the latest security patches (Vendor Advisory).