Use-after-free in ARM products - CVE-2023-6143

Vulnerability identifier: #VU87036

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-6143

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.    

The vulnerability exists due to a use-after-free error. A local user can trigger a use-after-free error and execute arbitrary code on the system.

Midgard GPU Kernel Driver
Valhall GPU Kernel Driver
Bifrost GPU Kernel Driver
Arm 5th Gen GPU Architecture Kernel Driver
Google Android

Install updates from vendor's website.

Valhall GPU Kernel Driver - update to r47p0
Arm 5th Gen GPU Architecture Kernel Driver - update to r47p0
Bifrost GPU Kernel Driver - update to r19p0
Google Android - addressed in versions 11 2024-03-05, 12L 2024-03-05, 12 2024-03-05, 13 2024-03-05, 14 2024-03-05

• https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

• Use-after-free in Arm Mali GPU kernel drivers
• Multiple vulnerabilities in Google Android