CVE-2023-26083
Arm Mali GPU Kernel Driver Information Disclosure Vulnerability
Description
CVE-2023-26083 is a memory leak vulnerability in the Arm Mali GPU Kernel Driver that allows a non-privileged local user to expose sensitive kernel metadata through valid GPU processing operations. The vulnerability affects multiple Arm GPU driver families including Midgard (r6p0 through r32p0), Bifrost (r0p0 through r42p0), Valhall (r19p0 through r42p0), and 5th Gen GPU Architecture (r41p0 through r42p0). While rated Low severity with a CVSS score of 3.3, this information disclosure vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. The EPSS score of 7.1% (91st percentile) indicates a notably high exploitation probability for a vulnerability of this severity level, suggesting it is being used as part of larger exploit chains targeting mobile devices and embedded systems.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| arm | 5th gen gpu architecture kernel driver | >= r41p0, < r43p0 |
| arm | bifrost gpu kernel driver | >= r0p0, < r43p0 |
| arm | midgard gpu kernel driver | >= r6p0, <= r32p0 |
| arm | valhall gpu kernel driver | >= r19p0, < r43p0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities(Vendor Advisory)
- https://www.cybersecurity-help.cz/vdb/SB2023033049(Third Party Advisory)
- https://www.cybersecurity-help.cz/vulnerabilities/74210/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26083(US Government Resource)
Weakness Type
CWE-401: Missing Release of Memory after Effective Lifetime
In CVE-2023-26083, the Arm Mali GPU Kernel Driver fails to properly release memory allocations after they are no longer needed during GPU processing operations. This memory leak weakness allows sensitive kernel metadata to persist in memory and become accessible to non-privileged users through standard GPU operations, exposing information that should be protected by kernel-level access controls.
Learn more: CWE-401 — Missing Release of Memory after Effective Lifetime
Impact Analysis
Despite its Low CVSS v3.1 severity rating of 3.3, CVE-2023-26083 has proven to be a significant security concern due to its real-world exploitation. The vulnerability requires local access with low-level privileges, but exploitation is straightforward with low attack complexity and no user interaction needed. Confidentiality (Low): The memory leak exposes sensitive kernel metadata, which while not directly granting full data access, provides attackers with valuable information about kernel memory layout that can be used to bypass kernel address space layout randomization (KASLR) and other memory protection mechanisms. The integrity and availability of the system are not directly affected by this vulnerability alone. However, the true danger lies in how this information disclosure is leveraged: threat actors use the leaked kernel metadata as a building block for more severe exploits that achieve code execution or privilege escalation on mobile devices and embedded systems running Arm Mali GPUs. The EPSS score of 7.1% (91st percentile) is remarkably high for a Low-severity vulnerability, reflecting its active use in real-world exploit chains.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-26083 in the wild by adding it to the Known Exploited Vulnerabilities catalog, a notable designation for a Low-severity vulnerability. While no public exploit code tagged as "Exploit" was found in the NVD references, third-party security advisories from Cybersecurity Help document the vulnerability details. The EPSS score of 7.1% (91st percentile) is unusually high for a CVSS 3.3 vulnerability, indicating that exploitation is well-established in the threat landscape. This memory leak vulnerability is typically chained with other Mali GPU driver vulnerabilities or kernel exploits to achieve privilege escalation on Android devices and other Arm-based platforms, serving as an information disclosure primitive that enables bypassing kernel memory protections.
Remediation
- Apply mitigations immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." The CISA remediation deadline was April 28, 2023. Check the Arm Security Center for the latest driver updates.
- Update the Mali GPU Kernel Driver to versions beyond the affected ranges: Midgard beyond r32p0, Bifrost beyond r42p0, Valhall beyond r42p0, and 5th Gen GPU Architecture beyond r42p0. For Android devices, apply the latest available security patch from the device manufacturer that includes the Arm Mali driver fix.
- Enforce mandatory security patch policies for all devices with Arm Mali GPUs in your organization, including smartphones, tablets, and embedded systems. Devices that cannot receive the updated driver should be evaluated for risk and potentially restricted from accessing sensitive corporate resources.
- Monitor device security patch levels across your mobile fleet using mobile device management (MDM) solutions. Flag devices running vulnerable Mali GPU driver versions and prioritize them for updates or impose additional access restrictions.
- Implement defense-in-depth measures on Arm-based systems by enabling all available kernel hardening features such as KASLR, SELinux enforcement, and memory tagging where supported. These mitigations reduce the effectiveness of the kernel metadata that this vulnerability leaks.
Technical Details
CVE-2023-26083 is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and affects the kernel-level GPU driver across four Arm Mali GPU architecture families. The vulnerability occurs when the Mali GPU Kernel Driver processes valid GPU operations but fails to properly free allocated memory, causing a memory leak that exposes sensitive kernel metadata to userspace applications. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects the local attack vector requiring low privileges, with only low confidentiality impact and no integrity or availability impact. A non-privileged user can trigger standard GPU processing operations that cause the driver to leak kernel memory addresses and other metadata, information that is critical for constructing reliable kernel exploits. The broad range of affected driver versions across Midgard, Bifrost, Valhall, and 5th Gen GPU architectures means this vulnerability impacts a vast number of devices, from older smartphones to current-generation Arm-based platforms.
Frequently Asked Questions
Is CVE-2023-26083 being actively exploited?
Yes, CVE-2023-26083 is actively exploited in the wild despite its Low CVSS severity rating. CISA has added it to the Known Exploited Vulnerabilities catalog. The ransomware association is currently unknown, but the vulnerability is used in exploit chains targeting mobile and embedded devices with Arm Mali GPUs.
What products are affected by CVE-2023-26083?
CVE-2023-26083 affects four Arm Mali GPU Kernel Driver families: Midgard (versions r6p0 through r32p0), Bifrost (r0p0 through r42p0), Valhall (r19p0 through r42p0), and 5th Gen GPU Architecture (r41p0 through r42p0). This impacts a wide range of Android smartphones, tablets, Chromebooks, and embedded systems using Arm Mali GPUs.
How do I fix CVE-2023-26083?
Update the Arm Mali GPU Kernel Driver to a version beyond the affected ranges by applying the latest security patches from your device manufacturer or the Arm Security Center. For managed device fleets, use MDM solutions to track and enforce patching of vulnerable devices. See the Remediation section for detailed steps.
How severe is CVE-2023-26083?
While CVE-2023-26083 has a Low CVSS v3.1 score of only 3.3, its real-world severity is significantly higher than the score suggests. The EPSS score places it in the 91st percentile for exploitation probability, and CISA has confirmed active exploitation. The vulnerability serves as an information disclosure primitive that enables more severe attacks through exploit chaining.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.