CVE-2023-4211
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Description
CVE-2023-4211 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver that allows a local non-privileged user to perform improper GPU memory processing operations and gain access to already freed memory. This security flaw affects multiple Arm GPU architectures, including Midgard, Bifrost, Valhall, and 5th Gen GPU kernel drivers. By exploiting CVE-2023-4211, an attacker with local access could read sensitive data from GPU memory, potentially exposing confidential information processed by the GPU. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and organizations using devices with Arm Mali GPUs should apply vendor-provided patches without delay.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| arm | 5th gen gpu architecture kernel driver | >= r41p0, < r43p0 |
| arm | bifrost gpu kernel driver | >= r0p0, < r43p0 |
| arm | midgard gpu kernel driver | >= r12p0, <= r32p0 |
| arm | valhall gpu kernel driver | >= r19p0, < r43p0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
Weakness Type
CWE-416: Use After Free
A use-after-free vulnerability occurs when a program continues to reference memory after it has been freed, potentially allowing an attacker to execute arbitrary code or access sensitive data. In the case of CVE-2023-4211, the Arm Mali GPU Kernel Driver fails to properly manage GPU memory lifecycle operations, enabling a local attacker to access memory regions that have already been deallocated and may contain sensitive data from other GPU operations.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2023-4211 is rated Medium severity with a CVSS 3.1 score of 5.5, reflecting a focused but meaningful security risk. The vulnerability requires local access to exploit but has low attack complexity, meaning once an attacker has a foothold on a device with an affected Arm Mali GPU, exploitation is straightforward with no special conditions needed. Low privileges are sufficient and no user interaction is required to trigger the use-after-free condition. Confidentiality (High): The primary impact is the unauthorized disclosure of sensitive data residing in GPU memory, which could include rendered content, cryptographic operations, or other data processed by the GPU. Integrity (None): The vulnerability does not allow modification of data or system state. Availability (None): No denial-of-service impact has been identified. While the scope remains unchanged and the impact is limited to confidentiality, the widespread use of Arm Mali GPUs in mobile devices, Chromebooks, and embedded systems means that the potential exposure is significant across consumer and enterprise environments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-4211 in the wild by including it in the Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of October 24, 2023. Although no public exploit code or proof-of-concept has been identified in the available references, the KEV listing and Arm's own security advisory confirm that this vulnerability is being leveraged by threat actors in real-world attacks. The EPSS score of 0.26% (49th percentile) suggests that while automated mass exploitation is not widespread, targeted exploitation — particularly against mobile devices and embedded systems — remains an active concern. The ransomware association is currently listed as unknown.
Remediation
- Apply GPU kernel driver updates from Arm as directed by the KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Consult the Arm Security Center advisory for the latest patched driver versions.
- Update all devices using affected Arm Mali GPU drivers, including those with Midgard, Bifrost, Valhall, and 5th Gen GPU architecture kernel drivers. For Android devices, ensure the latest vendor security patches are applied through OEM update channels.
- Restrict local access to systems running affected GPU drivers by enforcing device management policies, disabling sideloading of untrusted applications, and implementing mobile device management (MDM) controls to limit the attack surface.
- Monitor for signs of exploitation by reviewing device logs for unusual GPU memory access patterns, unexpected application crashes related to GPU operations, or indicators of information exfiltration from GPU memory buffers.
- Implement memory safety hardening where possible by enabling kernel address space layout randomization (KASLR), using secure boot configurations, and deploying endpoint protection solutions that can detect use-after-free exploitation attempts at the kernel level.
Technical Details
CVE-2023-4211 is a use-after-free vulnerability (CWE-416) in the Arm Mali GPU Kernel Driver that affects the GPU memory management subsystem. The flaw occurs when GPU memory processing operations fail to properly track the lifecycle of allocated memory regions, allowing a local user to reference GPU memory after it has been freed and potentially reallocated for other purposes. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms that the attack is locally exploitable with low complexity, requiring only standard user privileges and no user interaction. The vulnerability specifically impacts how the kernel driver handles memory deallocation and subsequent access patterns — when freed memory is accessed, the attacker can read data that was stored by other GPU operations, including potentially sensitive rendering data, compute shader outputs, or other information processed through the GPU pipeline. The scope remains unchanged, meaning the impact is confined to the GPU driver component, but the high confidentiality impact reflects the potential for significant data exposure.
Frequently Asked Questions
Is CVE-2023-4211 being actively exploited?
Yes, CVE-2023-4211 is confirmed to be actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 24, 2023. While the ransomware association is unknown, the confirmed active exploitation means organizations should prioritize patching affected devices.
What products are affected by CVE-2023-4211?
CVE-2023-4211 affects multiple Arm Mali GPU Kernel Driver families, including the Midgard GPU Kernel Driver, Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, and the 5th Gen GPU Architecture Kernel Driver. These drivers are widely used in Android smartphones, tablets, Chromebooks, and various embedded systems.
How do I fix CVE-2023-4211?
Apply the latest GPU kernel driver updates from Arm as referenced in the Arm Security Center advisory. For Android devices, install the latest vendor security patches through your OEM's update channel. Additionally, restrict local access and enforce device management policies. See the Remediation section for detailed steps.
How severe is CVE-2023-4211?
CVE-2023-4211 is rated Medium severity with a CVSS 3.1 score of 5.5. While the impact is limited to confidentiality (no integrity or availability impact), the widespread use of Arm Mali GPUs across mobile and embedded platforms creates a large potential attack surface. The EPSS score of 0.26% (49th percentile) indicates targeted rather than mass exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.