Junglewise Threat Intelligence

CVE-2023-26083: Arm Mali GPU Kernel Driver Information Disclosure Vulnerability

CVE-2023-26083 · Severity: critical · CVSS 3.3 · Exploited in the wild · Published 2023-04-07

Technologies: Arm Valhall GPU Kernel Driver, Arm Bifrost GPU Kernel Driver, Arm Mali Graphics Processing Unit (GPU). Vendors: Arm.

Executive brief

A memory leak vulnerability in various Arm Mali GPU Kernel Drivers allows a non-privileged local user to perform GPU processing operations that expose sensitive kernel metadata. This information disclosure can be used to bypass security mitigations.

Affected products

  • Arm Midgard GPU Kernel Driver r6p0 - r32p0
  • Arm Bifrost GPU Kernel Driver r0p0 - r42p0
  • Arm Valhall GPU Kernel Driver r19p0 - r42p0
  • Arm Avalon GPU Kernel Driver r41p0 - r42p0

Timeline

  • 2023-04-06: disclosed
  • 2023-04-07: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2023-04-07: exploited: Reported as exploited in the wild

Related threats