PT-2024-14597 · Arm · Arm Bifrost Gpu Kernel Driver+1

Published 2024-02-05 · Updated 2024-07-03 · CVE-2023-5249

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arm Ltd Bifrost GPU Kernel Driver versions r35p0 through r40p0 Arm Ltd Valhall GPU Kernel Driver versions r35p0 through r40p0

Description The issue allows a local non-privileged user to make improper memory processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, this can cause a use-after-free.

Recommendations For Arm Ltd Bifrost GPU Kernel Driver versions r35p0 through r40p0, update to a version outside of this range to resolve the issue. For Arm Ltd Valhall GPU Kernel Driver versions r35p0 through r40p0, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the GPU Kernel Drivers until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ASB-A-301630648

CVE-2023-5249

Affected Products

Arm Bifrost Gpu Kernel Driver

Arm Valhall Gpu Kernel Driver

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-5249 · Security Note
• https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5249 · Vendor Advisory
• https://twitter.com/CVEnew/status/1754448992522367224 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1754468611966615822 · Twitter Post
• https://t.me/cvenotify/70045 · Telegram Post