Actively exploited · Published Mar 3, 2022 · Assigned by mitre

CVE-2022-22706

High 7.8 Exploited

In plain English

A high-severity memory corruption in Mali Graphics Processing Unit (GPU) from Arm. Attackers are actively exploiting it in the wild (listed by CISA on March 30, 2023). The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)1.1%top 35.2% of all CVEs

Exploited in the wildYesCISA KEV since Mar 30, 2023

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 20, 2023.

Official description

Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 through r35p0.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://developer.arm.com/support/arm-security-updates x_refsource_MISC
https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22706 government-resource