Zero-day in Arm GPU drivers exploited in targeted attacks (CVE-2023-4211)

CVE-2022-22706 is a memory-safety flaw (CWE-119) in the Arm Mali GPU kernel driver that lets a local, non-privileged user gain write access to memory pages that should be read-only, potentially enabling privilege escalation or tampering with protected memory (CVSS 3.1: 7.8, local attack vector). It is triggered by a low-privileged local user interacting with the GPU driver on devices running affected Midgard (r26p0-r31p0), Bifrost (r0p0-r35p0), or Valhall (r19p0-r35p0) driver releases, which are widely shipped in Android SoCs such as those from MediaTek and HiSilicon. A successful attacker gains high confidentiality, integrity, and availability impact on the local device. CISA added the bug to the Known Exploited Vulnerabilities catalog on 2023-03-30, and security reporting ties Mali GPU driver zero-day exploitation to commercial spyware campaigns targeting Android and iOS users in Italy, Malaysia, Kazakhstan, and the UAE. The fix reached end users through vendor firmware, including the June 2023 Android security update.

Do: Apply updated Arm Mali GPU kernel drivers via your device/SoC vendor's firmware, ensuring Android endpoints are on security patch levels that include the fix (the June 2023 Android Security Bulletin shipped the Mali driver fix). Enterprises should inventory Android devices using Mali-based SoCs (e.g., MediaTek, HiSilicon) and prioritize patching devices exposed to spyware-targeted users; no workarounds are documented, and the CISA KEV required action is to apply updates per vendor instructions.

A memory leak (CWE-401) in Arm's Mali GPU kernel drivers affects Midgard (all versions r6p0-r32p0), Bifrost (all versions r0p0-r42p0), Valhall (all versions r19p0-r42p0), and Avalon (r41p0-r42p0), allowing a non-privileged local user to perform valid GPU processing operations that expose sensitive kernel metadata. A local attacker or app on an affected device gains an information-disclosure primitive that reads otherwise protected kernel memory (CVSS 3.1 base score 3.3, confidentiality impact only), potentially aiding further attacks. Exposure applies to any device whose CPU incorporates an affected Mali GPU and runs the corresponding driver, most commonly Android smartphones and tablets built on licensed Mali designs. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-04-07), indicating active exploitation, and Arm has issued patched drivers, with fixes also delivered through vendor/Android update channels; ransomware use is unknown.

Do: Apply Arm's patched Mali kernel driver releases (versions beyond the affected ranges) via your SoC/OEM vendor, and on Android devices install the latest Google/OEM security updates, per CISA's required action. Inventory fleets for devices running affected Mali driver generations (Android phones, tablets, and embedded/edge devices) and confirm they receive the fixed driver; note that patching is mandatory for U.S. federal agencies under the KEV program despite the low severity of this local information-disclosure flaw.

A local non-privileged user can make improper GPU processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.

A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory

CVE-2023-4211 is a use-after-free (CWE-416) in Arm's Mali GPU kernel drivers, covering the Midgard, Bifrost, Valhall and 5th Gen GPU Architecture product lines. A local, non-privileged attacker triggers the flaw by issuing improper GPU memory processing operations, causing the driver to access memory that has already been freed. Successful exploitation exposes already-freed kernel memory to the attacker (high confidentiality impact per the CVSS score), which on mobile devices can be chained into broader local information-gathering or privilege attacks. Any system running the affected Mali kernel drivers is exposed — in practice this is overwhelmingly Android smartphones, tablets and embedded devices whose SoCs integrate Mali GPUs. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2023-10-03, indicating confirmed in-the-wild exploitation; Arm has issued updated drivers, but patch availability varies by device vendor.

Do: Determine whether devices in your fleet use Mali GPUs and obtain updated Mali GPU kernel drivers from Arm via your device vendor's security updates (OEM/Android updates issued from October 2023 onward), since Arm fixes are distributed through device vendors rather than a standalone Arm patch channel. Until devices are patched, limit local, unprivileged access on affected systems to trusted users and monitor vendor bulletins for availability. Per the CISA KEV required action, apply vendor mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.