CVE-2024-20102: 
NixOS vulnerability analysis and mitigation

CVE-2024-20102 is a security vulnerability discovered in MediaTek's WLAN driver. The vulnerability was disclosed on October 6, 2024, affecting various MediaTek chipsets including MT3605, MT6985, MT6989, MT6990, MT7927, MT8678, MT8796, and MT8893. The issue stems from improper input validation in the WLAN driver component (MediaTek Bulletin).

The vulnerability is classified as an out-of-bounds read (CWE-125) due to improper input validation in the WLAN driver. It has been assigned a CVSS v3.1 base score of 4.9 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with low attack complexity (NVD).

The vulnerability could lead to remote information disclosure if successfully exploited, but only if the attacker has already obtained System execution privileges. The impact is limited to information disclosure without affecting system integrity or availability (MediaTek Bulletin).

The vulnerability affects Android versions 13.0 and 14.0, as well as SDK release 3.3 and earlier versions. MediaTek has developed patches for the affected devices and has notified device OEMs of the security patches at least two months before the public disclosure (MediaTek Bulletin).