CVE-2023-5249 - Mali GPU Kernel Driver allows improper GPU memory processing operations

Back Back to CVE browser

HIGH

Mali GPU Kernel Driver allows improper GPU memory processing operations

Published Feb 5, 2024

7.0

HIGH

CVSS 3.1

EPSS 0.15%

Description

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper memory processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn cause a use-after-free.This issue affects Bifrost GPU Kernel Driver: from r35p0 through r40p0; Valhall GPU Kernel Driver: from r35p0 through r40p0.

Affected products

Vendor Arm Ltd Product Bifrost GPU Kernel Driver Default
unaffected
- Version
  r35p0
  Status
  affected
  Constraints
  <=r40p0
Vendor Arm Ltd Product Valhall GPU Kernel Driver Default
unaffected
- Version
  r35p0
  Status
  affected
  Constraints
  <=r40p0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Arm Ltd

Bifrost GPU Kernel Driver

unaffected

Version	Status	Constraints
r35p0	affected	<=r40p0

Arm Ltd

Valhall GPU Kernel Driver

unaffected

Version	Status	Constraints
r35p0	affected	<=r40p0

Vendor ARM Product Bifrost Gpu Kernel Driver Default
n/a
- Version
  r35p0
  Status
  affected
  Constraints
  <=r40p0
Vendor ARM Product Valhall Gpu Kernel Driver Default
n/a
- Version
  r35p0
  Status
  affected
  Constraints
  <=r40p0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ARM

Bifrost Gpu Kernel Driver

n/a

Version	Status	Constraints
r35p0	affected	<=r40p0

ARM

Valhall Gpu Kernel Driver

n/a

Version	Status	Constraints
r35p0	affected	<=r40p0

Remediation

Vendor solution

This issue is fixed in the Bifrost and Valhall Kernel Driver in r41p0. Users are recommended to upgrade if they are impacted by this issue.

Weaknesses (1)

CWE-416

Use After Free

References (2)

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57574
Advisory

Link	Providers	Tags
https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities		Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57574		Advisory