Arm Mali GPU Kernel Driver安全绕过漏洞(CVE-2022-38181)

详细信息

漏洞类型

资源管理错误

漏洞描述

ARM Mali GPU Kernel Driver是英国ARM公司的一个图形处理器单元的驱动程序。ARM Mali GPU Kernel Driver可能允许通过远程身份验证的攻击者绕过安全限制，这是由于使用后出错造成的。通过进行不正确的GPU处理操作，攻击者可以利用此漏洞访问已释放的内存。漏洞影响Midgard GPU Kernel Driver r4p0 –r32p0所有版本、Bifrost GPU Kernel Driver r0p0 –r38p1所有版本以及r39p0版本、Valhall GPU Kernel Driver r19p0 –r38p1所有版本以及r39p0版本。

修复建议

此问题已在Bifrost和Valhall GPU内核驱动程序r38p2和r40p0中修复，补丁获取链接： https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

参考链接

• https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

  NVD · Vendor Advisory

• https://developer.arm.com/support/arm-security-updates

  NVD · Vendor Advisory

• https://cxsecurity.com/cveshow/CVE-2022-38181/
• https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/

  NVD · Exploit · Third Party Advisory

• http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html

  NVD · Third Party Advisory · VDB Entry

• https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/

  NVD · Exploit · Third Party Advisory

• https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202305-0000001532938728

  HarmonyOS

• https://source.android.com/security/bulletin/2023-04-01

  OSV

• https://osv.dev/vulnerability/ASB-A-259695958

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38181

  NVD · US Government Resource