CVE-2023-32849: 
NixOS vulnerability analysis and mitigation

CVE-2023-32849 is a medium severity vulnerability discovered in the cmdq component of MediaTek chipsets. The vulnerability was disclosed in December 2023 and affects various MediaTek chipset models running Android versions 11.0, 12.0, and 13.0. The issue stems from type confusion that could lead to an out-of-bounds write condition (MediaTek Bulletin).

The vulnerability is characterized by an incorrect comparison in the cmdq component that could result in an out-of-bounds write due to type confusion. It has been assigned a CVSS v3.1 base score of 6.7 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-697 (Incorrect Comparison) (NVD).

The vulnerability could lead to local escalation of privilege, requiring System execution privileges for exploitation. The affected systems include multiple MediaTek chipset models including MT6781, MT6785, MT6833, MT6853, MT6873, MT6885, MT6889, MT6893, and various MT87xx series chips (MediaTek Bulletin).

MediaTek has addressed this vulnerability and notified device OEMs of the security patches at least two months before publication. The fix was included in the December 2023 security bulletin (MediaTek Bulletin).