CVE-2024-20079: 
NixOS vulnerability analysis and mitigation

CVE-2024-20079 is a vulnerability discovered in MediaTek's GNSS service, reported on July 1, 2024. The vulnerability affects various MediaTek chipsets running Android versions 13.0 and 14.0. It is characterized as an out-of-bounds write vulnerability due to improper input validation (MediaTek Bulletin).

The vulnerability has been classified as CWE-787 (Out-of-bounds Write) with a CVSS v3.1 base score of 6.7 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in the GNSS service component and stems from improper input validation that could lead to an out-of-bounds write condition (NVD).

The vulnerability could lead to local escalation of privilege if a malicious actor has already obtained System execution privileges. The attack requires no user interaction for exploitation, potentially allowing an attacker to gain elevated privileges on the affected system (MediaTek Bulletin).

The vulnerability requires local access and high privileges for exploitation. No user interaction is needed for exploitation, though the attacker must already have System privileges to execute the attack. There are no public reports of this vulnerability being exploited in the wild (NVD).

The vulnerability affects multiple MediaTek chipsets including MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, and several others running Android 13.0 and 14.0. MediaTek has released patches and notified device OEMs of the security patches at least two months before the public disclosure (MediaTek Bulletin).