PT-2022-26516 · Arm · Arm Mali Gpu Kernel Driver

Published 2022-12-12 · Updated 2024-10-15 · CVE-2022-42716

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arm Mali GPU Kernel Driver versions Midgard r4p0 through r32p0 Arm Mali GPU Kernel Driver versions Bifrost r1p0 through r40p0 Arm Mali GPU Kernel Driver versions Valhall r19p0 through r40p0

Description A use-after-free issue was discovered in the Arm Mali GPU Kernel Driver, allowing a non-privileged user to make improper GPU processing operations to gain access to already freed memory.

Recommendations For versions Midgard r4p0 through r32p0, consider disabling the GPU processing operations until a patch is available. For versions Bifrost r1p0 through r40p0, restrict access to the GPU kernel driver to minimize the risk of exploitation. For versions Valhall r19p0 through r40p0, avoid using the GPU for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ASB-A-260148146

CVE-2022-42716

Affected Products

Arm Mali Gpu Kernel Driver

References · 8

• https://osv.dev/vulnerability/CVE-2022-42716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42716 · Security Note
• https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities · Vendor Advisory
• https://t.me/cvenotify/39947 · Telegram Post
• http://packetstormsecurity.com/files/170420/Arm-Mali-CSF-KBASE_REG_NO_USER_FREE-Unsafe-Use-Use-After-Free.html · Note
• https://t.me/cvenotify/39817 · Telegram Post
• https://t.me/cvenotify/41713 · Telegram Post
• https://t.me/cibsecurity/54357 · Telegram Post