CVE-2023-26083KEV · OVERDUE

Arm Mali GPU Kernel Driver Information Disclosure Vulnerability

Low · published April 6, 2023

Patch now

The score understates this — it's already being exploited

CVSS calls it low at 3.3. It is confirmed in active exploitation. It sits in the 68.4th percentile for exploit probability.

1274
days past CISA
deadline
CVSS v3.1
3.3
EPSS
1%
Percentile
68.4
In the wild
Confirmed
What it is

💡 A memory leak in the Mali GPU Kernel Driver could let non-privileged users access sensitive kernel metadata — think of it as someone peeking into the office files without being invited! Imagine a diner where a waiter accidentally leaves the kitchen door ajar, allowing customers to overhear the chefs discussing secret recipes. This memory leak lets unauthorized users catch a glimpse of sensitive information that should remain secure! While this vulnerability is rated low in severity, it still poses a risk by exposing sensitive kernel metadata. An attacker could glean insights that can lead to more significant issues, especially in future attacks targeting the system's integrity.

Put simply

Imagine a diner where a waiter accidentally leaves the kitchen door ajar, allowing customers to overhear the chefs discussing secret recipes. This memory leak lets unauthorized users catch a glimpse of sensitive information that should remain secure! This memory leak vulnerability in the Mali GPU Kernel Driver affects multiple versions and allows non-privileged users to perform GPU operations that inadvertently reveal sensitive kernel information stored in memory.

What to do

While this vulnerability is rated low in severity, it still poses a risk by exposing sensitive kernel metadata. An attacker could glean insights that can lead to more significant issues, especially in future attacks targeting the system's integrity. To safeguard your system, update to the latest versions of the Mali GPU Kernel Driver. Make sure to monitor logs for any unusual access patterns and consider restricting user permissions to limit access to sensitive information. You've got this! Patch up and keep your system secure. 🛡️

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01218 · 68.4th percentile
Published
2023-04-06T00:00Z
KEV added
2023-04-07 · due 2023-04-28
EPSS history
Timeline
  • 07 APR 00:00Z
    Added to CISA KEV — remediate by Apr 28
    kev
  • 06 APR 00:00Z
    Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from…
    cvelistv5