CVE-2023-28469

Vulnerability

The Arm Mali GPU Kernel Driver contains a use-after-free vulnerability. A non-privileged user can trigger improper GPU processing operations that lead to accessing already freed memory. This affects Valhall GPU Kernel Driver versions r29p0 through r42p0 (fixed in r43p0) and Arm's GPU Architecture Gen5 versions r41p0 through r42p0 (fixed in r43p0). [1]

Exploitation

An attacker requires only non-privileged user access to the system. By performing specific GPU processing operations, the attacker can cause the driver to reference memory that has already been freed, leading to a use-after-free condition. No additional authentication or special privileges are needed beyond local user access. [1]

Impact

Successful exploitation allows the attacker to read or write to freed memory, potentially leading to information disclosure, memory corruption, or escalation of privileges. The exact impact depends on the system configuration and the attacker's ability to control the freed memory contents. [1]

Mitigation

Arm has released version r43p0 for both Valhall and Gen5 architectures, which fixes the vulnerability. Users should update their Mali GPU Kernel Driver to r43p0 or later. No workarounds are mentioned in the available reference. [1]