CVE-2024-4610
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Description
CVE-2024-4610 is a high-severity use-after-free vulnerability in Arm's Bifrost and Valhall GPU Kernel Drivers that allows a local non-privileged user to exploit improper GPU memory processing operations to gain access to already freed memory. With a CVSS v3.1 base score of 7.8, the flaw affects Bifrost GPU Kernel Driver versions r34p0 through r40p0 and Valhall GPU Kernel Driver versions r34p0 through r40p0. CISA has added CVE-2024-4610 to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 3, 2024, and the ransomware association is currently unknown. The EPSS score of 0.76% at the 73rd percentile indicates moderate but notable exploitation probability, consistent with active exploitation in the wild on affected mobile and embedded devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| arm | bifrost gpu kernel driver | >= r34p0, < r41p0 |
| arm | valhall gpu kernel driver | >= r34p0, < r41p0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
Use After Free in GPU Memory Management
CVE-2024-4610 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver, specifically affecting the Bifrost and Valhall GPU architectures. A use-after-free condition occurs when a program continues to reference memory after it has been freed, creating an opportunity for an attacker to manipulate that memory region. In this case, the GPU kernel driver improperly handles memory processing operations, enabling a local non-privileged user to access memory that has already been deallocated. Use-after-free vulnerabilities in kernel-level GPU drivers are particularly dangerous because they operate at the highest privilege level in the system, and successful exploitation can lead to arbitrary code execution with kernel privileges. Learn more about use-after-free vulnerabilities at CWE-416.
Impact Analysis
The impact of CVE-2024-4610 is severe across all three CIA triad dimensions, with the CVSS vector reflecting complete compromise potential from a local attack surface. Confidentiality is fully compromised because successful exploitation of the use-after-free condition can allow an attacker to read arbitrary kernel memory, potentially exposing sensitive data such as cryptographic keys, authentication tokens, and other process memory contents that would normally be protected by kernel memory isolation.
Integrity faces maximum impact because the attacker can write to freed memory regions that may be reallocated for kernel data structures, enabling arbitrary code execution with kernel privileges. This means the attacker can modify system behavior, inject malicious code, and tamper with security controls at the most fundamental level of the operating system.
Availability is completely at risk since kernel-level memory corruption can cause system instability, crashes, or denial of service conditions. The local attack vector (AV:L) requires the attacker to have some form of local access to the device, which on mobile platforms typically means a malicious application installed on the device. The low attack complexity (AC:L) and low privilege requirement (PR:L) make this vulnerability accessible to any locally installed application. With the EPSS score at the 73rd percentile and active KEV listing, this vulnerability has demonstrated real-world exploitation, particularly targeting Android devices using Arm Mali GPUs.
Exploit Maturity
CVE-2024-4610 has confirmed active exploitation, leading CISA to add it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 3, 2024. Arm acknowledged in their security advisory that the vulnerability is being exploited in the wild, which is significant given that Mali GPUs power a vast number of Android smartphones, tablets, Chromebooks, and embedded systems worldwide.
The EPSS score of 0.76% at the 73rd percentile reflects moderate exploitation probability in the broader threat landscape. While this percentile may seem modest compared to network-exploitable vulnerabilities, local privilege escalation flaws in GPU drivers are frequently weaponized in targeted attack chains on mobile devices, where they serve as a critical link between initial application-level compromise and full device takeover. The Arm Security Center advisory confirms the vulnerability and provides details on affected driver versions. The ransomware association remains unknown, though the nature of the vulnerability makes it more relevant to mobile exploitation campaigns and espionage operations than traditional ransomware deployments.
Remediation
-
Update the GPU kernel driver to r41p0 or later. Arm has released patched versions of both the Bifrost and Valhall GPU Kernel Drivers starting from r41p0. Device manufacturers and OEMs should integrate the updated driver into their firmware and push updates to affected devices as soon as possible.
-
Apply Android security patches promptly. For Android devices, GPU driver fixes are typically distributed through monthly Android security bulletins. Ensure all devices in your organization are running the latest available Android security patch level that incorporates the fix for CVE-2024-4610.
-
Restrict application installation to trusted sources. Since exploitation requires local access through a malicious application, limit app installations to verified sources such as the Google Play Store and enforce mobile device management policies that prevent sideloading of untrusted applications.
-
Monitor for indicators of compromise on managed devices. Deploy mobile threat detection solutions that can identify anomalous GPU driver behavior, unexpected privilege escalation attempts, or known exploitation patterns associated with Mali GPU driver vulnerabilities.
-
Prioritize patching devices with sensitive data. Devices used for corporate email, authentication, banking, or handling sensitive data should be prioritized for updates. Consider temporarily restricting access to sensitive corporate resources from devices running vulnerable driver versions until patches are applied.
Technical Details
CVE-2024-4610 is a use-after-free vulnerability in Arm's Bifrost and Valhall GPU Kernel Drivers with a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, resulting in a high base score of 7.8. The local attack vector (AV:L) means the attacker must have local access to the target device, typically through a malicious application. The low attack complexity (AC:L) indicates that the vulnerability can be reliably triggered without requiring special conditions or race-condition timing.
The vulnerability resides in the GPU kernel driver's memory management subsystem, specifically in how the driver handles GPU memory processing operations. When certain sequences of GPU memory operations are performed, the driver fails to properly track memory allocation state, resulting in a condition where freed memory can be accessed through a dangling pointer. A local, non-privileged user (PR:L) can craft specific GPU memory operations through the driver's ioctl interface that trigger the use-after-free condition without requiring any user interaction (UI:N).
Once the freed memory is accessed, the attacker can potentially control what data occupies that memory region through heap spraying or other memory manipulation techniques, leading to arbitrary read and write primitives in kernel space. The scope remains unchanged (S:U), meaning the vulnerability's impact is contained within the kernel context, but since the GPU kernel driver operates at the highest system privilege level, full compromise of confidentiality (C:H), integrity (I:H), and availability (A:H) is achievable. The affected versions span Bifrost GPU Kernel Driver r34p0 through r40p0 and Valhall GPU Kernel Driver r34p0 through r40p0, with the fix delivered in r41p0.
Frequently Asked Questions
What is CVE-2024-4610?
CVE-2024-4610 is a high-severity use-after-free vulnerability in Arm's Bifrost and Valhall Mali GPU Kernel Drivers that allows a local non-privileged user to access already freed memory through improper GPU memory processing operations. It carries a CVSS v3.1 score of 7.8 and is actively exploited in the wild.
Which devices are affected by CVE-2024-4610?
Any device using Arm Mali Bifrost or Valhall GPU architectures with kernel driver versions r34p0 through r40p0 is affected. This includes a wide range of Android smartphones, tablets, Chromebooks, and embedded systems from manufacturers such as Samsung, MediaTek, and others that integrate Arm Mali GPUs.
How can CVE-2024-4610 be exploited?
Exploitation requires local access to the device, typically through a malicious application. The app can issue crafted GPU memory operations through the kernel driver's interface that trigger a use-after-free condition, potentially enabling kernel-level code execution and full device compromise.
Has CVE-2024-4610 been linked to ransomware?
CISA classifies the ransomware association as unknown for CVE-2024-4610. The vulnerability is more commonly associated with mobile exploitation chains used in targeted attacks and espionage campaigns rather than traditional ransomware operations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.