CVE-2023-4211: medium-severity vulnerability in Arm 5th Gen GPU Architecture Kernel Driver
Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A local user can access memory that was already freed on a Mali GPU, potentially exposing sensitive data or causing system instability. This happens because the GPU driver doesn't properly manage memory cleanup.
A use-after-free vulnerability (CWE-416) in the Mali GPU kernel driver allows a local unprivileged attacker to perform improper GPU memory operations and access freed memory. No special privileges are required; the attack vector is local and exploits insufficient memory state management in the GPU driver, potentially leading to information disclosure or denial of service.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.