Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-07-07

[ Description ]Official description

. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.

CISA: Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 28 Jul 2023): Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driverVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource