Arm Alerts on Mali GPU Vulnerabilities Likely Exploited in Targeted Cyber Attacks

October 2, 2023

Arm, in a recent security advisory, has brought attention to an actively exploited vulnerability in the Mali GPU drivers, known as CVE-2023-4211. This flaw was identified and reported by Google's Threat Analysis Group and Project Zero. The vulnerability is described as an improper access to freed memory, which could allow for the compromise or manipulation of sensitive data.

The advisory from Arm states, “A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.” The company has also discovered evidence suggesting that the vulnerability “may be under limited, targeted exploitation.” The driver versions that are impacted by the vulnerability include the Midgard, Bifrost, and Valhall series.

These series were introduced in 2013, 2016, and 2019 respectively, which implies that they are found in older device models. Notably, the Valhall architecture (Mali-G77) is used in popular devices such as the Samsung Galaxy S20/S20 FE, Xiaomi Redmi K30/K40, Motorola Edge 40, and OnePlus Nord 2. Arm’s fifth-generation GPU architecture, which was introduced in May 2023, uses the Mali-G720 and Mali-G620 chips, which are designed for premium, high-performance smartphones.

Arm has addressed the vulnerability for the Bifrost, Valhall, and Arm's 5th Gen GPU architecture with the release of kernel driver version r43p0 on March 24, 2023. However, the Midgard series, which is no longer supported, is unlikely to receive a patch for CVE-2023-4211. The availability of a patch for a vulnerable device is contingent on the device maker and vendor's ability to integrate it into a reliable update. Given the varying complexities of supply chains, some users may receive the fix sooner than others.

Alongside CVE-2023-4211, Arm also disclosed two other flaws, CVE-2023-33200 and CVE-2023-34970, in the same bulletin. These vulnerabilities allow a non-privileged user to exploit a race condition to perform improper GPU operations to access already freed memory. These flaws impact Bifrost, Valhall and Arm's 5th Gen GPU architecture kernel driver versions up to r44p0. The recommended upgrade targets are r44p1 and r45p0, which were released on September 15, 2023. All three vulnerabilities can be exploited by an attacker with local access to the device, typically achieved by tricking users into downloading applications from unofficial repositories.

Latest News

Like what you see?

Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.

Subscribe Below

By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.

Accelerate Security Teams

Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.