CVE-2022-46396

Vulnerability

An issue in the Arm Mali Kernel Driver allows a non-privileged user to perform improper GPU memory processing operations, resulting in a limited out-of-bounds memory access. This affects Valhall GPU driver versions r29p0 through r41p0 and Avalon GPU driver version r41p0, with the fix included in r42p0 [1].

Exploitation

An attacker requires local non-privileged access to the system. By triggering specific GPU memory processing operations (likely via IOCTL calls or GPU command submissions), the attacker can read a small amount of memory outside the intended buffer bounds. No additional user interaction is needed beyond executing the exploit [1].

Impact

Successful exploitation enables the attacker to read a limited amount of out-of-bounds memory, leading to information disclosure. The vulnerability does not directly provide code execution or privilege escalation [1].

Mitigation

Arm has released driver version r42p0 which resolves the issue. Users should update to r42p0 or later. No workarounds are documented, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog as of the publication date [1].