CVE-2022-32618: 
NixOS vulnerability analysis and mitigation

In typec, there is a possible out of bounds write vulnerability due to an incorrect calculation of buffer size. This vulnerability was assigned CVE-2022-32618 and was disclosed in November 2022. The vulnerability affects MediaTek chipsets including MT6833, MT6873, MT6893, and MT8798 running Android versions 11.0, 12.0, and 13.0 (Vendor Advisory).

The vulnerability is classified as CWE-131 (Incorrect Calculation of Buffer Size) and received a CVSS v3.1 base score of 6.8 MEDIUM (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue stems from improper buffer size calculation in the typec component, which could lead to an out-of-bounds write condition (NVD).

If exploited, this vulnerability could lead to local escalation of privilege. The attack requires physical access to the device but does not need additional execution privileges or user interaction for exploitation (Vendor Advisory).

MediaTek has addressed this vulnerability through a security patch identified as ALPS07262454. Device manufacturers have been notified of the issue and corresponding security patches at least two months before public disclosure (Vendor Advisory).