Arm in a security advisory warns of a vulnerability found in active use and affecting the widely used Mali GPU.
See also: Hackers steal data via GPU pixel theft attack
The currently identified vulnerability is referenced as CVE-2023-4211 and was discovered and reported to Arm by researchers from Google 's Threat Analysis Group (TAG) and Project Zero.
Details that are not publicly available describe a security issue related to improper access to freed memory. This issue could lead to the compromise or unwanted processing of sensitive data.
"A local unprivileged user can perform improper operations to access already freed memory," Arm explains in the advisory.
The company adds that it has found evidence that the vulnerability "may be under limited, targeted exploitation."
The following driver versions are affected by the vulnerability:
- Midgard GPU Core Driver: All versions from r12p0 to r32p0
- Bifrost GPU Core Driver: All versions from r0p0 to r42p0
- Valhall GPU Core Driver: All versions from r19p0 to r42p0
- Arm 5th Gen GPU Architecture Core Driver: All versions from r41p0 to r42p0
See also: Starfield: Loses entire stars when running on AMD Radeon GPUs
The Midgard , Bifrost , and Valhall series were introduced in 2013, 2016, and 2019, respectively. Therefore, they are older device models. Popular devices using the Valhall (Mali-G77) architecture include the Samsung Galaxy S20/S20 FE , the Xiaomi Redmi K30/K40 , the Motorola Edge 40 , and the OnePlus Nord 2 .
The fifth generation of Arm's GPU architecture was introduced to the market in May 2023. The Mali-G720 and Mali-G620 are aimed at high-performance smartphones.
The vendor states that the vulnerability has been addressed for Bifrost, Valhall, and 5th generation Arm GPU architectures with kernel driver version r43p0 (released March 24, 2023). Midgard is no longer supported, so it is unlikely that an updated version of the code for CVE-2023-4211 will be found.
The availability of a patch for a vulnerable device depends on how quickly the device manufacturer and vendor integrate it into a trusted update. As the complexity of the supply chain varies, some users will receive the fix faster than others.
See also: Nvidia GPU: BIOS lock broken for the first time since 2013
Protecting your device from Mali GPU flaws is a significant challenge, but there are some things you can do to reduce the risk of vulnerabilities being exploited.
First and foremost, it is essential to keep your device’s applications and operating system up to date. Software security updates prevent known vulnerabilities in your device from being exploited. Check for software updates regularly and install them as soon as possible. Additionally, avoid installing applications from untrusted sources. These applications may have been tampered with to exploit vulnerabilities in the Mali GPU. It is also worth noting that as Arm continues to discover and patch Mali GPU flaws, new vulnerabilities are likely to emerge in the future.
By implementing the above steps, you can ensure your device's defense against attacks targeting Mali GPU vulnerabilities.
