Out-of-bounds write in ARM products - CVE-2023-5643

Vulnerability identifier: #VU86162

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-5643

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Arm kernel driver. A local application can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.

Arm 5th Gen GPU Architecture Kernel Driver
Valhall GPU Kernel Driver
Bifrost GPU Kernel Driver
Google Android

Install updates from vendor's website.

Arm 5th Gen GPU Architecture Kernel Driver - update to r46p0
Valhall GPU Kernel Driver - update to r46p0
Bifrost GPU Kernel Driver - update to r46p0
Google Android - addressed in versions 11 2024-02-05, 12L 2024-02-05, 12 2024-02-05, 13 2024-02-05, 14 2024-02-05

• https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

• Privilege escalation in Arm Mali GPU kernel drivers
• Multiple vulnerabilities in Google Android