Arm Issues Patch for Mali GPU Kernel Driver Vulnerability Amidst Ongoing Exploitation

Arm has produced security patches to have a security flaw in the Mali GPU Kernel Driver that has arrive below lively exploitation in the wild.

Tracked as CVE-2023-4211, the shortcoming impacts the adhering to driver variations –

• Midgard GPU Kernel Driver: All versions from r12p0 – r32p0
• Bifrost GPU Kernel Driver: All variations from r0p0 – r42p0
• Valhall GPU Kernel Driver: All versions from r19p0 – r42p0
• Arm 5th Gen GPU Architecture Kernel Driver: All versions from r41p0 – r42p0

“A local non-privileged person can make improper GPU memory processing operations to get obtain to currently freed memory,” Arm explained in a Monday advisory. “There is proof that this vulnerability could be underneath constrained, targeted exploitation.”

The issue, credited to Maddie Stone of Google’s Danger Evaluation Group (TAG) and Jann Horn of Google Job Zero, has been resolved in Bifrost, Valhall and Arm 5th Gen GPU Architecture Kernel Driver r43p0.

Google, in its very own regular monthly Android Security Bulletin for October 2023, explained it located indications of targeted exploitation of CVE-2023-4211 and CVE-2023-4863, a serious flaw impacting the WebP impression structure in the Chrome web browser that was patched final month.

Precise particulars surrounding the nature of the attacks are continue to unclear, but indications are that they may perhaps have been weaponized as portion of a spy ware campaign concentrating on large-risk individuals.

Also solved by Arm are two other flaws in the Mali GPU Kernel Driver that let for improper GPU memory processing functions –

• CVE-2023-33200 – A local non-privileged person can make incorrect GPU processing functions to exploit a application race affliction. If the system’s memory is meticulously ready by the person, then this in switch could give them accessibility to now freed memory.
• CVE-2023-34970 – A neighborhood non-privileged consumer can make inappropriate GPU processing functions to obtain a restricted amount outdoors of buffer bounds or to exploit a program race ailment. If the system’s memory is meticulously organized by the consumer, then this, in convert, could give them accessibility to by now freed memory.

This is not the very first time flaws in Arm Mali GPU Kernel Driver have come below active exploitation. Before this 12 months, Google TAG disclosed that CVE-2023-26083 was abused in conjunction with a collection of 4 other flaws by a adware seller to penetrate Samsung devices.

Identified this short article fascinating? Abide by us on Twitter  and LinkedIn to go through more distinctive material we post.

Some parts of this article are sourced from:
thehackernews.com