[ CVE-2023-4211 · Published 1 Oct 2023 ]
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Exploited · CISA KEV CVSS 5.5
EPSS 1%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-10-03
[ Description ]Official description
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
CISA: Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 24 Oct 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource