CVE-2023-34970: Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations

Reference Links

• https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
• https://source.android.com/docs/security/bulletin/2023-10-01/#asterisk
• https://source.android.com/docs/security/bulletin/2023-10-01 (Advisory)

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2023-4211
• CVE-2023-33200

Frequently Asked Questions

• What is the vulnerability ID for this issue?

  The vulnerability ID for this issue is CVE-2023-34970.

• What is the severity of CVE-2023-34970?

  The severity of CVE-2023-34970 is high, with a CVSS score of 4.7.

• How can a local non-privileged user exploit CVE-2023-34970?

  A local non-privileged user can exploit CVE-2023-34970 by making improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition.

• Which software is affected by CVE-2023-34970?

  The Arm Mali GPU Kernel Driver, Arm Valhall Gpu Kernel Driver, and Google Android are affected by CVE-2023-34970.

• How can I fix CVE-2023-34970?

  To fix CVE-2023-34970, it is recommended to apply the latest security patches provided by the software vendors and follow the recommendations in the security bulletins.