Arm Mali GPU Kernel Driver Information Disclosure
CVE-2023-26083 is a low-severity missing release of memory after effective lifetime vulnerability in 5th Gen GPU Architecture Kernel Driver from Arm, with a CVSS 3.1 base score of 3.3 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists version r43p0 as the first without the flaw, so updating 5th Gen GPU Architecture Kernel Driver to that release or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on April 7, 2023, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Update 5th Gen GPU Architecture Kernel Driver to r43p0 or a later version.
- Update Bifrost GPU Kernel Driver to r43p0 or a later version.
- Update Valhall GPU Kernel Driver to r43p0 or a later version.
- CISA's required action: Apply updates per vendor instructions.
- Read the advisory on developer.arm.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Arm | 5th Gen GPU Architecture Kernel Driver | r41p0 up to, but not including, r43p0 | r43p0 |
| Arm | Bifrost GPU Kernel Driver | r0p0 up to, but not including, r43p0 | r43p0 |
| Arm | Midgard GPU Kernel Driver | r6p0 through r32p0 | Not stated |
| Arm | Valhall GPU Kernel Driver | r19p0 up to, but not including, r43p0 | r43p0 |
Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- LowSome restricted data can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 3.3 | Low | NVD |
| CVSS 3.1 | 3.3 | Low | CISA (ADP) |
Official description
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
How developers prevent this class of flaw
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. For example, glibc in Linux provides protection against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic reference counting (ARC). To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std
- Use an abstraction library to abstract away risky APIs. Not a complete solution.
- Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
More Missing Release of Memory after Effective Lifetime vulnerabilities (CWE-401)
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- cybersecurity-help.cz/vdb/SB2023033049Third Party Advisory
- cybersecurity-help.cz/vulnerabilities/74210/Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26083US Government Resource
Other vulnerabilities in 5th Gen GPU Architecture Kernel Driver
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Recent Missing Release of Memory after Effective Lifetime vulnerabilities
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.8 High severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.