CVE-2023-4211 vulnerability in Arm Products
Published on October 1, 2023

A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This Arm Mali GPU Kernel Driver Use-After-Free Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.

The following remediation steps are recommended / required by October 24, 2023: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2023-4211 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2023-4211 has been classified to as a Dangling pointer vulnerability or weakness.

Products Associated with CVE-2023-4211

You can be notified by stack.watch whenever vulnerabilities like CVE-2023-4211 are published in these products:

Arm 5th Gen Gpu Architecture Kernel Driver

Arm Midgard

Arm Bifrost

Arm Valhall

Arm Bifrost Gpu Kernel Driver

Arm Valhall Gpu Kernel Driver

Arm Midgard Gpu Kernel Driver

What versions are vulnerable to CVE-2023-4211?