Arm vulnerability discovered in Mali GPU Drivers being actively taken advantage of in the wild

Pierluigi Paganini
June 11, 2024

Arm issues alert on an actively exploited vulnerability in Mali GPU Kernel Driver.

Arm has warned of an actively exploited vulnerability, identified as CVE-2024-4610, in Mali GPU Kernel Driver.

The flaw is a memory access issue that affects Bifrost GPU Kernel Driver (all versions from r34p0 to r40p0) and Valhall GPU Kernel Driver (all versions from r34p0 to r40p0).

According to the information in the advisory released by the company, “Unauthorized users with local non-privileged access can manipulate GPU memory operations improperly, allowing them to gain unauthorized access to already released memory. Arm has received reports of malicious exploitation of this vulnerability in real-world scenarios. Users are advised to apply updates if they are affected by this security issue.”

Resolution for the vulnerability has been provided in Bifrost and Valhall GPU Kernel Driver in version r41p0, which was released on November 24, 2022.

An unauthorized local attacker with non-privileged access is able to manipulate the system’s memory to perform improper GPU memory actions, enabling access to already freed memory.

If affected, it is recommended that users proceed with the necessary upgrades to mitigate this issue.

Stay up to date by following me on Twitter: @securityaffairs, Facebook, and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Mali GPU Kernel Driver)

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts