High severity · published Oct 25, 2022
CVE-2022-38181
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
In wildKEV
8.8
CVSS
18.5%
EPSS
Yes
On KEV
Description
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)18.5% · higher than 97% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 30, 2023
Federal remediation dueApr 20, 2023
Ransomware campaign useNot known
Affected products
Which versions
BG
Bifrost Gpu Kernel Driver · Arm
r0p0 through r38p1; r39p0 · source: NVD
MG
Midgard Gpu Kernel Driver · Arm
r4p0 through r31p0 · source: NVD
VG
Valhall Gpu Kernel Driver · Arm
r19p0 through r38p1; r39p0 · source: NVD
MG
Mali Graphics Processing Unit (GPU) · Arm
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38181
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
developer.arm.com
https://developer.arm.com/support/arm-security-updates
developer.arm.com
https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
github.blog
https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/
securitylab.github.com
https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/
packetstormsecurity.com
http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html
More from Bifrost Gpu Kernel Driver
8.8
CVE-2021-29256
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
8.8
CVE-2021-28663
Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
8.8
CVE-2021-28664
Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
7.8
CVE-2024-4610
Mali GPU Kernel Driver allows improper GPU memory processing operations
7.8
CVE-2022-22706
Arm Mali GPU Kernel Driver Unspecified Vulnerability