CVE-2024-20096: 
NixOS vulnerability analysis and mitigation

CVE-2024-20096 is a security vulnerability discovered in MediaTek's m4u component, first reported on October 6, 2024. The vulnerability affects various MediaTek chipsets running Android versions 12.0 through 15.0. This out-of-bounds read vulnerability occurs due to a missing bounds check in the m4u component (MediaTek Bulletin).

The vulnerability is classified as an out-of-bounds read (CWE-125) with a CVSS v3.1 base score of 4.4 (Medium). The attack vector is local (AV:L), with low attack complexity (AC:L), requiring high privileges (PR:H), and no user interaction (UI:N). The scope is unchanged (S:U), with high confidentiality impact (C:H) but no impact on integrity (I:N) or availability (A:N) (NVD).

If exploited, this vulnerability could lead to local information disclosure if an attacker has already obtained System execution privileges. The vulnerability specifically affects the m4u component and could potentially expose sensitive system information (MediaTek Bulletin).

MediaTek has addressed this vulnerability with patch ID: ALPS08996900. Device OEMs were notified of the issue and corresponding security patches at least two months before the public disclosure (MediaTek Bulletin).