CVE-2023-6143
published 2024-03-04CVE-2023-6143: Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen…
PriorityP345high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.18%
8.3th percentile
Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition to perform improper memory processing operations. If the system’s memory is carefully prepared by the user and the system is under heavy load, then this in turn cause a use-after-free.This issue affects Midgard GPU Kernel Driver: from r13p0 through r32p0; Bifrost GPU Kernel Driver: from r1p0 through r18p0; Valhall GPU Kernel Driver: from r37p0 through r46p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r46p0.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arm | 5th_gen_gpu_architecture_kernel_driver | >= r41p0 < r47p0 | r47p0 |
| arm | bifrost_gpu_kernel_driver | >= r1p0 < r19p0 | r19p0 |
| arm | midgard_gpu_kernel_driver | r13p0 – r32p0 | — |
| arm | valhall_gpu_kernel_driver | >= r37p0 < r47p0 | r47p0 |
| arm_ltd | arm_5th_gen_gpu_architecture_kernel_driver | r41p0 – r46p0 | — |
| arm_ltd | bifrost_gpu_kernel_driver | r1p0 – r18p0 | — |
| arm_ltd | midgard_gpu_kernel_driver | r13p0 – r32p0 | — |
| arm_ltd | valhall_gpu_kernel_driver | r37p0 – r46p0 | — |
| android | — | — | |
| mozilla | firefox | >= 0 < 114.0.1+build1-0ubuntu0.20.04.1 | 114.0.1+build1-0ubuntu0.20.04.1 |
| mozilla | firefox | >= 0 < 114.0.2+build1-0ubuntu0.20.04.1 | 114.0.2+build1-0ubuntu0.20.04.1 |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f279-w6jr-7xxj: Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5
ghsa_unreviewed·2024-03-04
CVE-2023-6143 [HIGH] CWE-416 GHSA-f279-w6jr-7xxj: Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5
Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition to perform improper memory processing operations. If the system’s memory is carefully prepared by the user and the system is under heavy load, then this in turn cause a use-after-free.This issue affects Midgard GPU Kernel Driver: from r13p0 through r32p0; Bifrost GPU Kernel Driver: from r1p0 through r18p0; Valhall GPU Kernel Driver: from r37p0 through r46p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r46p0.
OSV
firefox regressions
osv·2023-06-21·CVSS 3.1
firefox regressions
firefox regressions
USN-6143-1 fixed vulnerabilities and USN-6143-2 fixed minor regressions in
Firefox. The update introduced several minor regressions. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2023-34414,
CVE-2023-34416, CVE-2023-34417)
Jun Kokatsu discovered that Firefox did not properly validate site-isolated
process for a document loaded from a data: URL that was the result of a
redirect, leading to an open redirect attack. An attacker could possibly
use this issue
OSV
firefox regressions
osv·2023-06-13·CVSS 3.1
CVE-2023-34414 firefox regressions
firefox regressions
USN-6143-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2023-34414,
CVE-2023-34416, CVE-2023-34417)
Jun Kokatsu discovered that Firefox did not properly validate site-isolated
process for a document loaded from a data: URL that was the result of a
redirect, leading to an open redirect attack. An attacker could possibly
use this issue to perform phishing attacks. (CVE-2023
Android
CVE-2023-6143: Mali
vendor_android·2024-03-01·CVSS 8.4
CVE-2023-6143 [HIGH] CVE-2023-6143: Mali
Android Security Bulletin 2024-03-01
CVE: CVE-2023-6143
Severity: HIGH
Component: Mali
References: A-316197619
*
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-03-04
Published