Vulnerability · Published Oct 3, 2023 · Assigned by Arm
CVE-2023-34970Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations
Medium 4.7
In plain English
A medium-severity use-after-free in Arm 5th Gen GPU Architecture Kernel Driver from Arm Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.2%top 86.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arm Ltd | Valhall GPU Kernel Driver | r44p0 – before r44p1 |
| Arm Ltd | Arm 5th Gen GPU Architecture Kernel Driver | r41p0 – before r44p1 |
Weakness: CWE-416, CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H