CVE-2022-36449
A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings.
Does this matter?
Lower severity and a low EPSS score (1.18%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 1.18% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- arm/bifrost gpu kernel driver · arm/midgard gpu kernel driver · arm/valhall gpu kernel driver
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/168431/Arm-Mali-Released-Buffer-Use-After-Free.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/168432/Arm-Mali-Physical-Address-Exposure.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/168433/Arm-Mali-Race-Condition.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/168434/Arm-Mali-CSF-Missing-Buffer-Size-Check.htmlThird Party Advisory, VDB Entry
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory
- http://packetstormsecurity.com/files/168431/Arm-Mali-Released-Buffer-Use-After-Free.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/168432/Arm-Mali-Physical-Address-Exposure.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/168433/Arm-Mali-Race-Condition.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/168434/Arm-Mali-CSF-Missing-Buffer-Size-Check.htmlThird Party Advisory, VDB Entry
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.