CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2022-38181
High (8.8) in Arm Mali Graphics Processing Unit (GPU). In CISA KEV since 2023-03-30. EPSS 18% chance of exploitation in the next 30 days.
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.
Severity
- EPSS
- 18% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2023-03-30, due 2023-04-20
- CWE
- CWE-416
- Published
- Modified
- Record from
- the NVD, synced
Affected
- arm:bifrost_gpu_kernel_driver
- arm:midgard_gpu_kernel_driver
- arm:valhall_gpu_kernel_driver
References
- http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
- https://developer.arm.com/support/arm-security-updates
- https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/
- https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/