CriticalCVE-2023-4211

    Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations (CVE-2023-4211)

    Published In CISA KEV since Sources: OSV, pwn.watch, CVE.org

    Share

    What is affected, what to do

    A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

    The vulnerability is being actively exploited; treat it as a priority. Update 5th_gen_gpu_architecture_kernel_driver to version r43p0, bifrost_gpu_kernel_driver to version r43p0, valhall_gpu_kernel_driver to version r43p0. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Arm Midgard GPU Kernel Driver gte r12p0..*
    • Arm Bifrost GPU Kernel Driver gte r0p0..*
    • Arm Valhall GPU Kernel Driver gte r19p0..*
    • Arm 5th Gen GPU Architecture Kernel Driver gte r41p0..*

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    5.5

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    5.5

    CVSS v3

    Severity Medium on the scale from 0 to 10.

    Source: OSV, pwn.watch, CVE.org

    1.0 %

    EPSS score

    Low — model estimates < 1% exploitation likelihood.

    Source: FIRST EPSS, percentile 61.8

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    161.56 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    5.5 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    5.5
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    1.0 %
    Low — model estimates < 1% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    61.8
    High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · not automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 15 November 2023
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-416

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This is a local-only flaw that needs just low privileges. It exposes freed kernel memory, and in practice it serves as a kernel privilege-escalation stage in multi-step exploit chains against mobile devices, typically in targeted rather than mass campaigns. Mass-exploitation likelihood is moderate, and CISA reports no known ransomware use. The real risk is the targeted compromise of high-exposure individuals and their MFA and communications data. Organisations with large Android fleets or Mali-based OT/HMI hardware should rate this high, especially because of the unpatched Midgard estate. Desktop- and server-only environments without Mali hardware can treat it as low priority.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Inventory affected assets: Identify every device with an Arm Mali GPU. This covers corporate Android phones and tablets, Chromebooks, and embedded Linux such as HMI panels, thin clients, kiosks and IoT gateways. On Linux, confirm the driver with ls -l /dev/mali* plus cat /sys/module/mali_kbase/version or dmesg | grep -i kbase.
      • Upgrade the driver: Move Bifrost, Valhall and 5th Gen Architecture kernel drivers to r43p0 or later. Affected ranges are Bifrost r0p0–r43p0, Valhall r19p0–r43p0 and 5th Gen r41p0–r43p0. For mobile devices the fix arrives via the OEM's Android security update. Patch available from the vendor — look up the exact patch level in the OEM or Android security bulletin.
      • Handle Midgard separately: The context lists no fix for the Midgard GPU kernel driver (r12p0–r32p0). Treat these devices as permanently vulnerable and schedule them for retirement. Until then, apply the compensating controls below.
      • Enforce a minimum patch level via MDM: Set a minimum security patch level in Intune, Workspace ONE or a similar MDM. Block non-compliant devices from mail, VPN and M365 through Conditional Access.
      • Prioritise high-value users: Check and update devices belonging to executives, admins, OT on-call staff and anyone holding crypto material or MFA tokens first.

    2. Runbook step 2

      Mitigation layers

      • Mobile endpoint hardening: Disable sideloading and "unknown sources" via MDM. Restrict app installs to Managed Google Play or a work profile. Exploitation requires local code execution, typically through a malicious or compromised app.
      • Access control on embedded Linux: Lock down the device node, for example chown root:video /dev/mali0 && chmod 0660 /dev/mali0, and persist it with a udev rule. Add only service accounts that genuinely need GPU access to the video group.
      • Least privilege: Give kiosk and HMI operators no interactive shell accounts and set user accounts to nologin. Run containers without --device /dev/mali0 unless they actually need the GPU.
      • Network segmentation: Move unpatchable Midgard and embedded devices into a dedicated VLAN. Allow egress only to defined update and management endpoints. This limits lateral movement after a successful privilege escalation.
      • Mobile Threat Defense: Enable an MTD product such as Defender for Endpoint (Android), Lookout or Zimperium to flag root indicators and exploit behaviour. Feed its risk signal into Conditional Access.

    3. Runbook step 3

      Detection rules

      • auditd (Linux/embedded): Log access to the GPU node by unexpected processes with -w /dev/mali0 -p rwa -k mali_access. Then hunt for processes outside your allowlist: ausearch -k mali_access | grep -v -E "Xorg|weston|<app>".
      • Kernel log: Forward dmesg/journald output to the SIEM and alert on BUG: KASAN: use-after-free, kbase oopses, Unable to handle kernel paging request or unexplained kernel panics. Sigma shape: logsource: linux/kernel, keywords: ["kbase", "use-after-free"].
      • Privilege escalation: Using Sysmon for Linux EID 1 or auditd execve records, watch for processes running with uid=0 whose parent runs under an unprivileged app or user account. Example SPL: index=linux sourcetype=auditd type=EXECVE euid=0 auid!=0 auid!=4294967295.
      • MDM/MTD telemetry: Triage alerts for "device rooted", "privilege escalation", SELinux switched to permissive, or unexpected bootloader state changes. Example KQL: DeviceInfo | where OSPlatform == "Android" and OnboardingStatus == "Onboarded" | join DeviceTvmSoftwareVulnerabilities on DeviceId | where CveId == "CVE-2023-4211".

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

    Source: OSV (Open Source Vulnerabilities), pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    Arm LtdArm 5th Gen GPU Architecture Kernel Driver
    • ≥ r41p0
    • —
    Arm LtdBifrost GPU Kernel Driver
    • ≥ r0p0
    • —
    Arm LtdMidgard GPU Kernel Driver
    • ≥ r12p0
    • —
    Arm LtdValhall GPU Kernel Driver
    • ≥ r19p0
    • —
    arm5th_gen_gpu_architecture_kernel_driver
    • r41p0 – < r43p0
    • r43p0
    armbifrost_gpu_kernel_driver
    • r0p0 – < r43p0
    • r43p0
    armmidgard_gpu_kernel_driver
    • r12p0 – ≤ r32p0
    • —
    armvalhall_gpu_kernel_driver
    • r19p0 – < r43p0
    • r43p0
    android:unknown:
    • SoCVersion:0
    • SoCVersion
    • SoCVersion:2023-10-05
    • —

    Vendors and products

    Weakness classes (CWE)

    • CWE-416Use After Free

      Variant

      The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

      Entry at MITRE CWE-416

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited

    References & sources

    • source.android.comsecurity/bulletin/2023-09-01advisory
    • source.android.comsecurity/bulletin/2023-10-01advisory
    • developer.arm.comVendor advisory: Arm Mali GPU Kernel DriverVendor advisory, pwn-watch
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4211government-resource, US government resource
    • pwn.watchpwn.watch: Arm Mali GPU Kernel Driver: Use-After-Free (CVE-2023-4211)pwn-watch
    • NVD (NIST)NVD: CVE-2023-4211pwn-watch
    • cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2023-4211
    <a href="https://intel.neosec.eu/en/cve/CVE-2023-4211"><img src="https://intel.neosec.eu/badge/cve/CVE-2023-4211.svg?lang=en" alt="CVE-2023-4211 – NEOSEC Intel" height="20"></a>