Physical memory disclosure via stale GPU mappings
Published Aug 2, 2022 · Updated Aug 3, 2024
Use-after-free in Arm Mali GPU Kernel Driver Valhall r29p0 through r38p0 allows local users to read freed physical memory. The command-stream frontend virtual memory area split path leaves GPU mappings able to reference backing pages after the driver frees them. A nonprivileged process with native code execution and access to the Mali device can use the stale mapping to disclose data from reallocated physical pages.
Summary
What happened
Use-after-free in Arm Mali GPU Kernel Driver Valhall r29p0 through r38p0 allows local users to read freed physical memory. The command-stream frontend virtual memory area split path leaves GPU mappings able to reference backing pages after the driver frees them. A nonprivileged process with native code execution and access to the Mali device can use the stale mapping to disclose data from reallocated physical pages.
The record
- CVE
- CVE-2022-33917
- Published
- Aug 2, 2022
- Updated
- Aug 3, 2024
- Vendor
- Unknown vendor
- Product
- Unknown product
- Classifications
- Unavailable
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- Aug 2, 2022CVE publishedPublication date reported by the CVE source.
- Aug 3, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
What conditions does exploitation require?
What is affected?
Affected products and versions are unavailable in this record.
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
No sourced classifications are available.
Public exploit references
- DMGuard Mali map-after-free reproductionproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo