CVE-2022-46394

Vulnerability

The Arm Mali GPU Kernel Driver contains a use-after-free vulnerability (CVE-2022-46394) where a non-privileged user can perform improper GPU processing operations to access already freed memory [1][2]. This affects Valhall GPU kernel driver versions r39p0 through r41p0, and Avalon GPU kernel driver version r41p0, prior to the fixed version r42p0.

Exploitation

An attacker with local non-privileged access to a system using an affected Mali GPU driver can trigger the vulnerability by submitting specially crafted GPU processing operations. The exact sequence of operations leads to the use of a memory object after it has been freed, resulting in a use-after-free condition.

Impact

Successful exploitation allows the attacker to read or write freed memory, potentially leading to information disclosure of sensitive data or escalation of privileges. The attacker gains access to memory that should be protected, which could be leveraged for further compromise.

Mitigation

Arm has released driver version r42p0 which fixes the vulnerability for both Valhall and Avalon architectures [1][2]. Users should update their GPU kernel driver to r42p0 or later. No workarounds have been publicly documented.