CVE-2022-22706
Arm Mali GPU Kernel Driver Unspecified Vulnerability
Description
CVE-2022-22706 is a high-severity memory boundary violation vulnerability in the Arm Mali GPU Kernel Driver that allows a non-privileged user to achieve write access to read-only memory pages. The vulnerability affects the Midgard, Bifrost, and Valhall GPU driver families across numerous versions, impacting a wide range of Android devices and embedded systems using Arm Mali graphics processors. By exploiting CVE-2022-22706, an attacker with low-level access could modify read-only memory, potentially leading to privilege escalation or arbitrary code execution at the kernel level. CISA has confirmed active exploitation of this Arm Mali GPU vulnerability by adding it to the Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| arm | bifrost gpu kernel driver | >= r0p0, < r36p0 |
| arm | midgard gpu kernel driver | >= r26p0, < r32p0 |
| arm | valhall gpu kernel driver | >= r19p0, < r36p0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://developer.arm.com/support/arm-security-updates(Vendor Advisory)
- https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22706(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
The memory buffer boundary violation in CVE-2022-22706 occurs when the Arm Mali GPU kernel driver fails to properly enforce read-only memory page protections, allowing unprivileged users to write to memory regions that should be immutable. In the context of the Mali GPU driver, this improper restriction enables attackers to corrupt kernel memory structures by writing to pages intended to be read-only.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2022-22706 carries a CVSS v3.1 score of 7.8 (High), representing a significant security threat to devices using Arm Mali GPUs. Attack Vector (Local): The vulnerability requires local access to the device, typically through a malicious application running on the system. Attack Complexity (Low): Exploitation is straightforward with no special conditions or race conditions needed. Privileges Required (Low): Only basic, non-privileged user access is required to trigger the vulnerability, making it accessible to any installed application. User Interaction (None): No action from the device user is required for the attack to succeed. Confidentiality, Integrity, and Availability (all High): Successful exploitation grants write access to read-only kernel memory pages, allowing an attacker to modify critical system data, escalate privileges to kernel level, and potentially crash or fully compromise the device. While the EPSS score of 0.09% (26th percentile) suggests relatively limited exploitation probability, the confirmed active exploitation by CISA makes immediate remediation essential.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-22706 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of April 20, 2023. No publicly available exploit code or proof-of-concept has been identified in the reference materials, though vendor advisories from Arm describe the vulnerability in detail. The EPSS score of 0.09% (26th percentile) indicates that while widespread automated exploitation is not currently observed, the confirmed in-the-wild exploitation and the broad footprint of affected Mali GPU devices make this vulnerability a priority for remediation.
Remediation
- Apply vendor patches immediately. As directed by CISA, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Update Arm Mali GPU kernel drivers to versions beyond the affected ranges: Midgard beyond r31p0, Bifrost beyond r35p0, and Valhall beyond r35p0, as documented in the Arm Security Center.
- Deploy Android security updates on affected devices, as the Arm Mali GPU driver fix is typically distributed through Android security bulletins. Coordinate with device manufacturers (OEMs) to ensure patched kernel drivers are available and applied.
- Restrict untrusted application installation on devices with affected Arm Mali GPUs by enforcing application whitelisting, sandboxing, or mobile device management (MDM) policies. Since the vulnerability can be triggered by non-privileged users, limiting which applications can run reduces the attack surface.
- Monitor kernel logs and device behavior for signs of unexpected memory access violations, GPU driver crashes, or privilege escalation attempts that could indicate exploitation of CVE-2022-22706. Enable kernel audit logging where available.
- Enable kernel memory protection features such as kernel address space layout randomization (KASLR), read-only memory enforcement (CONFIG_STRICT_KERNEL_RWX), and hardware memory tagging to make exploitation of memory boundary violations more difficult.
Technical Details
CVE-2022-22706 is a memory boundary violation (CWE-119) in the Arm Mali GPU kernel driver that allows a non-privileged user to gain write access to memory pages marked as read-only. The vulnerability stems from improper restriction of operations within memory buffer boundaries, where the driver fails to properly enforce page-level protections during GPU memory management operations. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires local access and low privileges but is low-complexity and needs no user interaction, with all three impact metrics at High due to the ability to modify kernel-level read-only memory. The affected driver versions span three GPU architecture families: Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 through r35p0, meaning the vulnerability is present across multiple generations of Arm Mali GPU hardware.
Frequently Asked Questions
Is CVE-2022-22706 being actively exploited?
Yes, CVE-2022-22706 has been confirmed as actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of April 20, 2023. There is no known association with ransomware campaigns at this time.
What products are affected by CVE-2022-22706?
CVE-2022-22706 affects the Arm Mali GPU kernel driver across three architecture families: Midgard (r26p0 through r31p0), Bifrost (r0p0 through r35p0), and Valhall (r19p0 through r35p0). This impacts a wide range of Android smartphones, tablets, Chromebooks, and embedded systems that use Arm Mali graphics processors.
How do I fix CVE-2022-22706?
Update the Arm Mali GPU kernel driver to a version beyond the affected ranges, specifically beyond r31p0 for Midgard, r35p0 for Bifrost, and r35p0 for Valhall. Apply the latest Android security patches from your device manufacturer and restrict untrusted application installation on affected devices.
How severe is CVE-2022-22706?
CVE-2022-22706 has a CVSS v3.1 score of 7.8 (High severity). Although the EPSS percentile of 26.1% suggests moderate exploitation probability, the confirmed active exploitation by CISA and the ability to write to read-only kernel memory make this a high-priority vulnerability requiring immediate attention.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.