PT-2022-6514 · Arm · Arm Mali Gpu Kernel Driver

Published 2022-01-06 · Updated 2026-04-17 · CVE-2022-22706

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arm Mali GPU Kernel Driver versions r26p0 through r31p0 Arm Mali GPU Kernel Driver versions r0p0 through r35p0 Arm Mali GPU Kernel Driver versions r19p0 through r35p0

Description The Arm Mali GPU Kernel Driver has a vulnerability related to insufficient access control, allowing a non-privileged user to gain write access to read-only memory pages. This issue affects the Midgard, Bifrost, and Valhall architectures. The vulnerability can be exploited to elevate privileges. According to reports, the time it takes to fix and integrate patches for such vulnerabilities can be significant, making known vulnerabilities as effective as zero-day exploits for attackers.

Recommendations For Arm Mali GPU Kernel Driver versions r26p0 through r31p0, update to a version that includes the fix for this vulnerability. For Arm Mali GPU Kernel Driver versions r0p0 through r35p0, update to a version that includes the fix for this vulnerability. For Arm Mali GPU Kernel Driver versions r19p0 through r35p0, update to a version that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the vulnerable driver until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-264

CWE-119

Related Identifiers

ASB-A-225040268

BDU:2023-01878

CVE-2022-22706

Affected Products

Arm Mali Gpu Kernel Driver

References · 26

• https://bdu.fstec.ru/vul/2023-01878 · Security Note
• https://developer.arm.com/support/arm-security-updates · Vendor Advisory
• https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22706 · Security Note
• https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities · Security Note
• https://osv.dev/vulnerability/CVE-2022-22706 · Vendor Advisory
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://twitter.com/CyberMeowly/status/1889067864273137957 · Twitter Post
• https://t.me/cybersecuritytechnologies/6761 · Telegram Post
• https://twitter.com/linkersec/status/1893079114254340564 · Twitter Post
• https://twitter.com/linkersec/status/2045257325993185480 · Twitter Post
• https://vuldb.com/ru/?id.194162 · Note
• https://t.me/cibsecurity/38361 · Telegram Post
• https://t.me/cvenotify/117988 · Telegram Post
• https://t.me/linkersec/293 · Telegram Post