Arm Issues Patch for Mali GPU Kernel Driver Vulnerability Amidst Ongoing Exploitation

Arm has produced security patches to contain a security flaw in the Mali GPU Kernel Driver that has occur less than energetic exploitation in the wild.

Tracked as CVE-2023-4211, the shortcoming impacts the pursuing driver variations –

• Midgard GPU Kernel Driver: All versions from r12p0 – r32p0
• Bifrost GPU Kernel Driver: All variations from r0p0 – r42p0
• Valhall GPU Kernel Driver: All versions from r19p0 – r42p0
• Arm 5th Gen GPU Architecture Kernel Driver: All versions from r41p0 – r42p0

“A local non-privileged person can make inappropriate GPU memory processing operations to obtain entry to already freed memory,” Arm mentioned in a Monday advisory. “There is evidence that this vulnerability might be below limited, qualified exploitation.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The issue, credited to Maddie Stone of Google’s Risk Assessment Group (TAG) and Jann Horn of Google Venture Zero, has been tackled in Bifrost, Valhall and Arm 5th Gen GPU Architecture Kernel Driver r43p0.

Google, in its very own month to month Android Security Bulletin for Oct 2023, explained it discovered indications of targeted exploitation of CVE-2023-4211 and CVE-2023-4863, a significant flaw impacting the WebP picture structure in the Chrome web browser that was patched very last month.

Specific details encompassing the nature of the attacks are nonetheless unclear, but indications are that they may perhaps have been weaponized as element of a spyware marketing campaign targeting superior-risk people.

Also solved by Arm are two other flaws in the Mali GPU Kernel Driver that permit for incorrect GPU memory processing operations –

• CVE-2023-33200 – A neighborhood non-privileged person can make incorrect GPU processing operations to exploit a software package race problem. If the system’s memory is very carefully well prepared by the consumer, then this in switch could give them access to already freed memory.
• CVE-2023-34970 – A nearby non-privileged person can make poor GPU processing functions to entry a confined quantity outside the house of buffer bounds or to exploit a software package race issue. If the system’s memory is very carefully ready by the consumer, then this, in change, could give them entry to currently freed memory.

This is not the first time flaws in Arm Mali GPU Kernel Driver have arrive less than lively exploitation. Before this 12 months, Google TAG disclosed that CVE-2023-26083 was abused in conjunction with a series of 4 other flaws by a spyware vendor to penetrate Samsung gadgets.

Uncovered this article exciting? Observe us on Twitter  and LinkedIn to read through additional special content material we publish.