CVE Vulnerability Advisory Database

[Affected Scope] Arm Bifrost GPU Kernel Driver and Valhall GPU Kernel Driver from r34p0 through r40p0.

[Impact] A local non-privileged user can exploit this vulnerability to access already freed memory, potentially leading to arbitrary code execution and kernel privilege escalation.

[Mitigation] Immediately upgrade the Arm Mali GPU kernel driver to version r41p0 or later.

[Affected Scope] Android and embedded devices utilizing ARM Mali GPU Midgard, Bifrost, Valhall, and 5th Gen architecture drivers

[Impact] A local non-privileged user can exploit improper GPU memory processing operations to access freed memory (Use-After-Free), potentially leading to local privilege escalation and sensitive kernel data exposure

[Mitigation] Apply the latest security patches and kernel driver updates provided by chipset vendors and device OEMs immediately

[Affected Scope] ARM Mali GPU Kernel Drivers (Midgard r6p0-r32p0, Bifrost r0p0-r42p0, Valhall r19p0-r42p0, Avalon r41p0-r42p0)

[Impact] A local non-privileged user can perform valid GPU processing operations to expose sensitive kernel metadata, facilitating KASLR bypass and local privilege escalation (LPE)

[Mitigation] Apply official security patches from chipset vendors and OEMs, and immediately upgrade device firmware to the latest version

[Affected Scope] Android and embedded devices utilizing Arm Mali GPU Bifrost (r0p0 to r38p1, r39p0), Valhall (r19p0 to r38p1, r39p0), and Midgard (r4p0 to r32p0) drivers

[Impact] Local unprivileged attackers can exploit a Use-After-Free (UAF) condition in GPU memory operations to gain arbitrary kernel code execution and full root privileges

[Mitigation] Apply the latest security patches provided by chipset vendors and OEMs, and immediately upgrade vulnerable driver versions

[Affected Scope] Android devices powered by kernels utilizing the ARM Mali GPU driver

[Impact] Local attackers can achieve local privilege escalation (LPE) to kernel execution context without any user interaction

[Mitigation] Apply the March 2022 or later Android Security Patch Level (SPL) and update the kernel build

[Affected Scope] Devices equipped with ARM Mali GPU Kernel Driver Midgard (r26p0 to r31p0), Bifrost (r0p0 to r35p0), and Valhall (r19p0 to r35p0) architectures

[Impact] A local non-privileged user can gain write access to read-only memory pages, leading to local privilege escalation (LPE) and arbitrary code execution

[Mitigation] Apply the official security patches and upgrade to the latest driver versions (Bifrost/Valhall r36p0+, Midgard r32p0+) provided by ARM and device OEMs

[Affected Scope] ARM Mali GPU kernel driver Bifrost (r16p0 through r29p0), Valhall (r19p0 through r29p0), and Midgard (r28p0 through r30p0)

[Impact] An unprivileged local attacker can exploit a Use-After-Free (UAF) condition to access freed memory, leading to sensitive information disclosure or root privilege escalation

[Mitigation] Apply the official security patches from chipset vendors and OEMs, upgrading the Mali GPU kernel driver to version r30p0 or higher

[Affected Scope] Linux kernel before version 3.5.5 running on v6k and v7 ARM platforms, including affected Android devices

[Impact] Local attackers can exploit missing address validation in get_user and put_user APIs to read or write arbitrary kernel memory, leading to full root privilege escalation

[Mitigation] Upgrade the Linux kernel to version 3.5.5 or higher, or apply the latest security patches provided by your OS/device vendor