Arm Mali GPU Kernel Driver Information Disclosure Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-04-07

[ Description ]Official description

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

CISA: Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 28 Apr 2023): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory
• www.cybersecurity-help.cz/vdb/SB2023033049Third Party Advisory
• www.cybersecurity-help.cz/vulnerabilities/74210Third Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource