PT-2024-27068 · Arm · Arm Bifrost Gpu Kernel Driver+2

Published 2024-09-03 · Updated 2024-09-07 · CVE-2024-3655

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arm Ltd Bifrost GPU Kernel Driver versions r43p0 through r49p0 Arm Ltd Valhall GPU Kernel Driver versions r43p0 through r49p0 Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r43p0 through r49p0

Description The issue allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory. This is a result of a Use After Free vulnerability in the affected drivers.

Recommendations For Arm Ltd Bifrost GPU Kernel Driver versions r43p0 through r49p0, upgrade the driver immediately to mitigate the risk. For Arm Ltd Valhall GPU Kernel Driver versions r43p0 through r49p0, upgrade the driver immediately to mitigate the risk. For Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r43p0 through r49p0, upgrade the driver immediately to mitigate the risk.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ASB-A-346629290

CVE-2024-3655

Affected Products

Arm 5Th Gen Gpu Architecture Kernel Driver

Arm Bifrost Gpu Kernel Driver

Arm Valhall Gpu Kernel Driver

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-3655 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3655 · Vendor Advisory
• https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1830948356241145914 · Twitter Post
• https://twitter.com/CVEnew/status/1830904021642522804 · Twitter Post
• https://twitter.com/xvonfers/status/1830941573405946251 · Twitter Post
• https://twitter.com/oktsec/status/1830957527204295035 · Twitter Post
• https://twitter.com/cracbot/status/1832660194314309906 · Twitter Post
• https://t.me/cvedetector/4675 · Telegram Post
• https://t.me/cvenotify/93031 · Telegram Post