Medium severity · published Sep 1, 2022
CVE-2022-36449
An issue was discovered in the Arm Mali GPU Kernel Driver
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BG
Bifrost Gpu Kernel Driver · Arm
r0p0 through r38p0; r39p0 · source: NVD
MG
Midgard Gpu Kernel Driver · Arm
r4p0 through r32p0 · source: NVD
VG
Valhall Gpu Kernel Driver · Arm
r19p0 through r38p0; r39p0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-36449
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-36449
Third Party Advisory
http://packetstormsecurity.com/files/168431/Arm-Mali-Released-Buffer-Use-After-Free.html
Third Party Advisory
http://packetstormsecurity.com/files/168432/Arm-Mali-Physical-Address-Exposure.html
Third Party Advisory
http://packetstormsecurity.com/files/168433/Arm-Mali-Race-Condition.html
Third Party Advisory
http://packetstormsecurity.com/files/168434/Arm-Mali-CSF-Missing-Buffer-Size-Check.html
Vendor Advisory
https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
More from Bifrost Gpu Kernel Driver
8.8
CVE-2022-38181
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
8.8
CVE-2021-29256
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
8.8
CVE-2021-28663
Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
8.8
CVE-2021-28664
Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
7.8
CVE-2024-4610
Mali GPU Kernel Driver allows improper GPU memory processing operations