CVE-2022-38181KEV · OVERDUE

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

High · published October 25, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 97.2th percentile for exploit probability.

1282
days past CISA
deadline
CVSS v3.1
8.8
EPSS
18%
Percentile
97.2
In the wild
Confirmed
What it is

🚨 Unprivileged users gaining access to freed memory? That's a glitch in the matrix! ⚡ This vulnerability in the Arm Mali GPU kernel driver is a game changer for Bifrost, Valhall, and Midgard series! Think of it like a restaurant where the kitchen mistakenly leaves the order slips behind after clearing the table. A sneaky diner can grab those slips and piece together previous customers’ orders, potentially getting sensitive information they shouldn’t have! An attacker could exploit this vulnerability to read sensitive data from freed memory, leading to the exposure of confidential information. This could result in unauthorized access to user data or even compromise system integrity—absolutely devastating!

Put simply

Think of it like a restaurant where the kitchen mistakenly leaves the order slips behind after clearing the table. A sneaky diner can grab those slips and piece together previous customers’ orders, potentially getting sensitive information they shouldn’t have! CVE-2022-38181 arises from mishandled GPU memory operations in the Arm Mali GPU kernel driver, allowing unprivileged users to access freed memory that should not be accessible.

What to do

An attacker could exploit this vulnerability to read sensitive data from freed memory, leading to the exposure of confidential information. This could result in unauthorized access to user data or even compromise system integrity—absolutely devastating! To safeguard your systems, patch to the latest drivers that address these issues. Ensure you’re on versions beyond r39 and regularly audit your GPU memory management practices. Don’t wait—tackle this today! You've got this! With these steps, you'll be back to security hero status in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.18461 · 97.2th percentile
Published
2022-10-25T00:00Z
KEV added
2023-03-30 · due 2023-04-20
EPSS history
Timeline
  • 30 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 20
    kev
  • 25 OCT 00:00Z
    The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled
    cvelistv5