CVE-2023-33200

—

CVSS 3.1

4.7 medium

EPSS

<1%p22

Published

Oct 3, 2023 (Oct 3, 2023)

Modified

Jun 17, 2026

Description

A local non-privileged user can make improper GPU processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.

Vendors: arm
Products: bifrost gpu kernel driver, mali gpu kernel driver, valhall gpu kernel driver
Weakness: CWE-416
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news5 stories

Arm and Qualcomm Hit by Multiple Zero

Infosecurity MagazineOct 4, 10:30 UTC · Oct 4, 2023Exploit / PoC in the wildCVE-2023-33106 CVE-2023-33107 CVE-2023-33063+6 CVEs

Arm Issues Patch for Mali GPU Kernel Driver Vulnerability Amidst Ongoing Exploitation

The Hacker NewsOct 3, 04:58 UTC · Oct 3, 2023Vulnerability in the wildCVE-2023-4211 CVE-2023-4863 CVE-2023-33200+2 CVEs

Zero-day in Arm GPU drivers exploited in targeted attacks (CVE-2023-4211)

Help Net SecurityOct 3, 00:00 UTC · Oct 3, 2023Exploit / PoC CVE-2023-4211 CVE-2022-22706 CVE-2023-26083+2 CVEs

Vulnerable Arm GPU drivers under active exploitation. Patches may not be available

Ars Technica · SecurityOct 2, 19:37 UTC · Oct 2, 2023Vulnerability in the wildCVE-2023-4211 CVE-2023-33200 CVE-2023-34970

Arm, Qualcomm warn GPU drivers are likely being exploited by hackers

The RecordOct 3, 17:07 UTC · Oct 3, 2023Vulnerability CVE-2023-4211 CVE-2023-33200 CVE-2023-34970