high
7
CWE
416 362
EPSS
0.051%
Advisory Published
CVE Published
Updated

CVE-2023-5249: Mali GPU Kernel Driver allows improper GPU memory processing operations

First published: Mon Feb 05 2024(Updated: )

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper memory processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn cause a use-after-free.This issue affects Bifrost GPU Kernel Driver: from r35p0 through r40p0; Valhall GPU Kernel Driver: from r35p0 through r40p0.

Credit: arm-security@arm.com

Affected SoftwareAffected VersionHow to fix
Arm Bifrost GPU Kernel Driver>=r35p0<=r40p0
Arm Ltd Valhall GPU Kernel Driver>=r35p0<=r40p0
Android

Remedy

This issue is fixed in the Bifrost and Valhall Kernel Driver in r41p0. Users are recommended to upgrade if they are impacted by this issue.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2023-5249?

    CVE-2023-5249 is classified as a high-severity vulnerability due to its potential to allow local non-privileged users to exploit a software race condition.

  • How do I fix CVE-2023-5249?

    To mitigate CVE-2023-5249, update the affected Arm Bifrost and Valhall GPU kernel drivers to the latest versions that address this vulnerability.

  • Which systems are affected by CVE-2023-5249?

    CVE-2023-5249 affects systems running specific versions of Arm Bifrost and Valhall GPU kernel drivers, as well as devices using the Google Android operating system.

  • What type of vulnerability is CVE-2023-5249?

    CVE-2023-5249 is a Use After Free vulnerability that can lead to improper memory processing operations.

  • Can CVE-2023-5249 be exploited remotely?

    CVE-2023-5249 requires local access to the affected system for exploitation, meaning it cannot be exploited remotely.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203