Arm has cautioned about a security flaw affecting Mali GPU Kernel Driver that has reportedly been actively leveraged in real-world scenarios.
Identified as CVE-2024-4610, the use-after-free issue impacts the following products –
“A local non-privileged user can execute improper operations related to GPU memory processing to gain access to memory that has already been freed,” the company stated in an advisory released last week.
The security vulnerability has been fixed in Bifrost and Valhall GPU Kernel Driver version r41p0. It is important to note that this particular version was made available in November 2022. The most recent version of the drivers is r49p0, which was released in April 2024.
The Hacker News has contacted Arm to seek clarification on whether this is an older security issue now being attributed a new CVE identification or if it is a recently discovered vulnerability. The story will be updated once a response is received.
The British chip manufacturer also acknowledged instances of the flaw being exploited in real-world attacks, but refrained from sharing additional details to prevent further misuse.
Previously disclosed zero-day vulnerabilities in Arm Mali GPU – CVE-2022-38181 and CVE-2023-4211 – have been weaponized by commercial spyware vendors for specific attacks targeting Android devices, with the exploitation of the latter associated with an Italian firm named Cy4Gate.
Users of affected products are advised to upgrade to the latest version as a precaution against potential risks.
About Author
