CVE-2023-4272 — Sensitive Information Exposure in LTD ARM 5TH GEN GPU Architecture Kernel Driver

CWE-200 — Sensitive Information ExposureCWE-1251 — Mirrored Regions with Different Values3 documents3 sources
Severity
5.5MEDIUMNVD
EPSS
0.3%
top 50.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
ARM LTD ARM 5TH GEN GPU Architecture Kernel DriverARM LTD Bifrost GPU Kernel DriverARM LTD Valhall GPU Kernel Driver+6 more
Timeline
PublishedNov 7
Latest updateDec 1

Description

A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages9 packages

▶CVEListV5arm_ltd/bifrost_gpu_kernel_driverr0p0 — r42p0
▶CVEListV5arm_ltd/valhall_gpu_kernel_driverr19p0 — r42p0
▶NVDarm/bifrost_gpu_kernel_driverr0p0 — r41p0
▶NVDarm/midgard_gpu_kernel_driverr8p0 — r32p0

🔴Vulnerability Details

1
GHSA
GHSA-gh94-rfj3-873r: A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory↗2023-11-14
▶

📋Vendor Advisories

1
Android
CVE-2023-4272: Mali↗2023-12-01
▶