CVE-2023-20606: 
NixOS vulnerability analysis and mitigation

CVE-2023-20606 affects the apusys component in MediaTek chipsets. The vulnerability was discovered and disclosed in February 2023. It is a medium severity information disclosure vulnerability that affects MediaTek chipsets MT6879, MT6895, and MT6983 running Android 12.0 and 12.1. The issue stems from an improper input validation vulnerability, specifically a missing bounds check (MediaTek Bulletin).

The vulnerability is classified as an improper input validation issue (CWE-20) in the apusys component. Due to a missing bounds check, there is a possible out-of-bounds read condition that could lead to information disclosure. The vulnerability requires System execution privileges for exploitation, and user interaction is not needed (MediaTek Bulletin).

The vulnerability could lead to local information disclosure with System execution privileges required. The scope of impact is limited to specific MediaTek chipsets (MT6879, MT6895, MT6983) running Android versions 12.0 and 12.1 (MediaTek Bulletin).

MediaTek has released security patches for the affected chipsets. Device OEMs were notified of the issues and corresponding security patches at least two months before the public disclosure in February 2023 (MediaTek Bulletin).