CVE-2023-4272

Mali GPU Kernel Driver exposes sensitive data from freed memory

State: Published
Severity: 5.5 Medium
Published: Nov 7, 2023
Updated: Sep 4, 2024
Reserved: Aug 9, 2023

Description

A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-1251 Mirrored Regions with Different Values
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Midgard GPU Kernel DriverArm Ltd	r8p0 through r32p0Affected
Bifrost GPU Kernel DriverArm Ltd	r0p0 to before r42p0Affectedfrom r42p0Not affected
Valhall GPU Kernel DriverArm Ltd	r19p0 to before r42p0Affectedfrom r42p0Not affected
Arm 5th Gen GPU Architecture Kernel DriverArm Ltd	r41p0 to before r42p0Affectedfrom r42p0Not affected

References

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.