Actively exploited · Published Apr 6, 2023 · Assigned by mitre
CVE-2023-26083
Low 3.3 Exploited
In plain English
A low-severity memory leak in Mali Graphics Processing Unit (GPU) from Arm. Attackers are actively exploiting it in the wild (listed by CISA on April 7, 2023). The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 28, 2023.
Official description
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
Affected products (as reported)
Weakness: CWE-401 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N