PT-2022-6367 · Arm · Arm Mali Gpu Kernel Driver

Published 2022-12-09 · Updated 2023-12-14 · CVE-2022-46891

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Arm Mali GPU Kernel Driver versions Midgard r13p0 through r32p0 Arm Mali GPU Kernel Driver versions Bifrost r1p0 through r40p0 Arm Mali GPU Kernel Driver versions Valhall r19p0 through r40p0

Description A non-privileged user can make improper GPU processing operations to gain access to already freed memory due to a use-after-free issue in the Arm Mali GPU Kernel Driver. This issue may allow a remote attacker to execute arbitrary code.

Recommendations For Arm Mali GPU Kernel Driver versions Midgard r13p0 through r32p0, update to a version that fixes the use-after-free issue. For Arm Mali GPU Kernel Driver versions Bifrost r1p0 through r40p0, update to a version that fixes the use-after-free issue. For Arm Mali GPU Kernel Driver versions Valhall r19p0 through r40p0, update to a version that fixes the use-after-free issue. As a temporary workaround, consider restricting access to the GPU processing operations until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ASB-A-260149319

BDU:2023-01056

CVE-2022-46891

Affected Products

Arm Mali Gpu Kernel Driver

References · 8

• https://osv.dev/vulnerability/CVE-2022-46891 · Vendor Advisory
• https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01056 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-46891 · Security Note
• https://t.me/pentestingnews/32269 · Telegram Post
• https://t.me/cibsecurity/56576 · Telegram Post
• https://vuldb.com/?id.218478 · Note
• https://t.me/cvenotify/42775 · Telegram Post