CVE-2022-38181
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Description
CVE-2022-38181 is a high-severity use-after-free vulnerability in the Arm Mali GPU kernel driver that allows unprivileged users to access freed memory due to mishandled GPU memory operations. The vulnerability affects the Bifrost, Valhall, and Midgard GPU kernel driver families across a wide range of versions, making it relevant to numerous Android devices and embedded systems that rely on Arm Mali GPUs. An attacker exploiting CVE-2022-38181 could potentially achieve heap corruption, leading to arbitrary code execution or privilege escalation. CISA has added this use-after-free vulnerability to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 24.5% (96th percentile), the likelihood of exploitation is significant.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| arm | bifrost gpu kernel driver | >= r0p0, <= r38p1; r39p0 |
| arm | midgard gpu kernel driver | >= r4p0, <= r31p0 |
| arm | valhall gpu kernel driver | >= r19p0, <= r38p1; r39p0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html(Third Party Advisory, VDB Entry)
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities(Vendor Advisory)
- https://developer.arm.com/support/arm-security-updates(Vendor Advisory)
- https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/(Exploit, Third Party Advisory)
- https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38181(US Government Resource)
Weakness Type
CWE-416: Use After Free
The use-after-free weakness in CVE-2022-38181 occurs when the Arm Mali GPU kernel driver references memory after it has been freed, allowing an attacker to manipulate the contents of that memory region. In the context of the Mali GPU driver, mishandled GPU memory operations enable unprivileged users to access freed memory, potentially corrupting the heap and gaining elevated execution privileges.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2022-38181 carries a CVSS v3.1 score of 8.8 (High), indicating a serious security vulnerability in the Arm Mali GPU kernel driver. Attack Vector (Network): The vulnerability is remotely exploitable without physical access to the device. Attack Complexity (Low): Exploitation is straightforward and does not require special conditions or preparation. Privileges Required (Low): Only basic user-level access is needed to trigger the vulnerability, making it accessible to any authenticated user on the system. User Interaction (None): No action is required from the victim for the exploit to succeed. Confidentiality, Integrity, and Availability (all High): Successful exploitation can lead to complete compromise of data confidentiality, system integrity through arbitrary code execution, and service availability through system crashes or denial of service. The EPSS score of 24.5% places this vulnerability in the 96th percentile, indicating a high likelihood of active exploitation.
Exploit Maturity
Public exploit code is available for CVE-2022-38181 via Packet Storm Security and detailed technical write-ups have been published by GitHub Security Lab and the GitHub Blog. CISA has confirmed active exploitation of CVE-2022-38181 in the wild by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of April 20, 2023. The EPSS score of 24.5% (96th percentile) reflects the significant probability of exploitation activity, consistent with the availability of public exploit code and confirmed in-the-wild attacks.
Remediation
- Apply vendor patches immediately. As directed by CISA, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Update Arm Mali GPU kernel drivers to versions that address CVE-2022-38181: Bifrost and Valhall drivers should be updated beyond r38p1 and r39p0, and Midgard drivers should be updated beyond r32p0.
- Deploy Android security updates on affected devices, as Google has incorporated the Arm Mali GPU driver fix into Android security bulletins. Coordinate with device manufacturers (OEMs) to ensure the latest security patches are applied.
- Restrict untrusted application execution on devices with Arm Mali GPUs by enforcing application whitelisting or sandboxing policies, as the vulnerability can be triggered by unprivileged users through malicious applications.
- Monitor system logs for signs of GPU driver crashes, unexpected memory access patterns, or privilege escalation attempts that may indicate exploitation of the use-after-free vulnerability.
- Implement kernel-level memory protections where available, such as enabling kernel address space layout randomization (KASLR) and hardware memory tagging extensions (MTE), to make exploitation of use-after-free vulnerabilities more difficult.
Technical Details
CVE-2022-38181 is a use-after-free vulnerability (CWE-416) in the Arm Mali GPU kernel driver caused by mishandled GPU memory operations. When GPU memory is freed but references to it are not properly invalidated, subsequent operations can access the freed memory region, leading to heap corruption. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the vulnerability is network-accessible with low attack complexity, requiring only low-level privileges and no user interaction. The vulnerability spans multiple driver families: Bifrost r0p0 through r38p1 and r39p0, Valhall r19p0 through r38p1 and r39p0, and Midgard r4p0 through r32p0, affecting a broad range of mobile and embedded devices that use Arm Mali GPUs.
Frequently Asked Questions
Is CVE-2022-38181 being actively exploited?
Yes, CVE-2022-38181 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 20, 2023. Public exploit code is available through Packet Storm Security and GitHub Security Lab, and the EPSS score of 24.5% (96th percentile) confirms a high exploitation probability.
What products are affected by CVE-2022-38181?
CVE-2022-38181 affects the Arm Mali GPU kernel driver across three families: Bifrost (r0p0 through r38p1 and r39p0), Valhall (r19p0 through r38p1 and r39p0), and Midgard (r4p0 through r32p0). This impacts a wide range of Android smartphones, tablets, and embedded devices using Arm Mali GPUs.
How do I fix CVE-2022-38181?
Update the Arm Mali GPU kernel driver to a version that addresses the vulnerability, specifically beyond r38p1/r39p0 for Bifrost and Valhall, and beyond r32p0 for Midgard. Apply the latest Android security patches from your device manufacturer, and restrict untrusted application installation on affected devices.
How severe is CVE-2022-38181?
CVE-2022-38181 has a CVSS v3.1 score of 8.8 (High severity) and ranks in the 96th EPSS percentile. The combination of confirmed active exploitation, publicly available exploit code, and the broad range of affected devices makes this vulnerability a critical priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.