Arm warns of Mali GPU flaws likely exploited in targeted attacks

Arm in a security advisory today is warning of an actively exploited vulnerability affecting the widely-used Mali GPU drivers.

The flaw is currently tracked as CVE-2023-4211 and was discovered and reported to Arm by researchers of Google’s Threat Analysis Group (TAG) and Project Zero.

Details are not publicly available but the security issue is described as an improper access to freed memory, a problem that could allow compromising or manipulating sensitive data.

“A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory,” Arm explains in the advisory.

The company adds that it has found evidence that the vulnerability “may be under limited, targeted exploitation.”

The following driver versions are impacted by the vulnerability:

• Midgard GPU kernel driver: All versions from r12p0 to r32p0
• Bifrost GPU kernel driver: All versions from r0p0 to r42p0
• Valhall GPU kernel driver: All versions from r19p0 to r42p0
• Arm 5th Gen GPU architecture kernel driver: All versions from r41p0 to r42p0

Midgard, Bifrost, and Valhall series were introduced in 2013, 2016, and 2019, respectively, so they concern older device models.

Popular devices using the Valhall architecture (Mali-G77) include the Samsung Galaxy S20/S20 FE, Xiaomi Redmi K30/K40, Motorola Edge 40, and OnePlus Nord 2.

Arm’s fifth-gen GPU architecture was introduced to the market in May 2023, with the Mali-G720 and Mali-G620 chips aimed at premium, high-performance smartphones.

The vendor says that the vulnerability has been addressed for the Bifrost, Valhall, and Arm 5th Gen GPU architecture with kernel driver version r43p0 (released on March 24, 2023). Midgard is no longer supported, so it is unlikely to get a patch for CVE-2023-4211.

The availability of a patch for a vulnerable device depends on how quickly the device maker and vendor manage to integrate it in a reliable update. As the complexities of the supply chain vary, some users will receive the fix sooner than others.

Other flaws Arm disclosed in the same bulletin are CVE-2023-33200 and CVE-2023-34970, which allow a non-privileged user to exploit a race condition to perform improper GPU operations to access already freed memory.

They impact Bifrost, Valhall and Arm's 5th Gen GPU architecture kernel driver versions up to r44p0, with the recommended upgrade targets being r44p1 and r45p0 (released on September 15, 2023).

All three vulnerabilities are exploitable by an attacker with local access on the device, which is typically achieved through tricking users to download applications from unofficial repositories.