CVE-2023-4272 : A local non-privileged user can make GPU processing operations that expose sensi

A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory.

Published 2023-11-07 16:15:29

Updated 2024-09-04 20:35:13

Source Arm Limited

View at NVD, CVE.org

Products affected by CVE-2023-4272

ARM » Bifrost Gpu Kernel Driver
Versions from including (>=) r0p0 and up to, including, (<=) r41p0
cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*
Matching versions
ARM » Valhall Gpu Kernel Driver
Versions from including (>=) r19p0 and up to, including, (<=) r41p0
cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*
Matching versions
ARM » Midgard Gpu Kernel Driver
Versions from including (>=) r8p0 and up to, including, (<=) r32p0
cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*
Matching versions
ARM » Mali Gpu Kernel Driver » Version: R41p0
cpe:2.3:a:arm:mali_gpu_kernel_driver:r41p0:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 18 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-09-04
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: arm-security@arm.com (Secondary)
CWE-1251 Mirrored Regions with Different Values

The product's architecture mirrors regions without ensuring that their contents always stay in sync.

Assigned by: arm-security@arm.com (Secondary)

Jump to