CVE-2023-32873: 
NixOS vulnerability analysis and mitigation

CVE-2023-32873 is a high-severity vulnerability discovered in MediaTek components affecting various Android devices. The vulnerability was disclosed on May 5, 2024, and affects multiple MediaTek chipsets running Android versions 12.0, 13.0, and 14.0. The issue exists in the keyInstall functionality where an out-of-bounds write vulnerability is present due to a missing bounds check (MediaTek Bulletin).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) with a CVSS v3.1 base score of 6.7 (Medium). The technical assessment shows that the vulnerability requires local access (AV:L) with low attack complexity (AC:L), high privileges (PR:H), and no user interaction (UI:N). The scope is unchanged (S:U) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

If exploited, this vulnerability could lead to local escalation of privilege with System execution privileges. The attacker would need to have already obtained System privilege level access to exploit this vulnerability. The impact affects multiple MediaTek chipsets including MT6761, MT6765, MT6768, MT6833, MT6853, MT6855, MT6893, MT6895, MT6983, and various MT83xx/MT87xx series (MediaTek Bulletin).

The vulnerability requires local access to the device and high privileges for exploitation. No user interaction is needed for exploitation, making it more straightforward to exploit once the prerequisite access is obtained (NVD).

MediaTek has released security patches for the affected devices. Device OEMs were notified of the issues and corresponding security patches at least two months before the public disclosure. Users should ensure their devices are updated with the latest security patches provided by their device manufacturers (MediaTek Bulletin).