CVE Vulnerability Advisory Database

[Affected Scope] Arm Bifrost GPU Kernel Driver and Valhall GPU Kernel Driver from r34p0 through r40p0.

[Impact] A local non-privileged user can exploit this vulnerability to access already freed memory, potentially leading to arbitrary code execution and kernel privilege escalation.

[Mitigation] Immediately upgrade the Arm Mali GPU kernel driver to version r41p0 or later.

[Affected Scope] ARM Mali GPU Kernel Drivers (Midgard r6p0-r32p0, Bifrost r0p0-r42p0, Valhall r19p0-r42p0, Avalon r41p0-r42p0)

[Impact] A local non-privileged user can perform valid GPU processing operations to expose sensitive kernel metadata, facilitating KASLR bypass and local privilege escalation (LPE)

[Mitigation] Apply official security patches from chipset vendors and OEMs, and immediately upgrade device firmware to the latest version

[Affected Scope] Android devices powered by kernels utilizing the ARM Mali GPU driver

[Impact] Local attackers can achieve local privilege escalation (LPE) to kernel execution context without any user interaction

[Mitigation] Apply the March 2022 or later Android Security Patch Level (SPL) and update the kernel build

[Affected Scope] ARM Mali GPU kernel driver Bifrost (r16p0 through r29p0), Valhall (r19p0 through r29p0), and Midgard (r28p0 through r30p0)

[Impact] An unprivileged local attacker can exploit a Use-After-Free (UAF) condition to access freed memory, leading to sensitive information disclosure or root privilege escalation

[Mitigation] Apply the official security patches from chipset vendors and OEMs, upgrading the Mali GPU kernel driver to version r30p0 or higher