CVE-2023-5643
📋 TL;DR
This CVE describes an out-of-bounds write vulnerability in Arm Mali GPU kernel drivers that allows a local non-privileged user to perform improper GPU memory operations. If exploited, it could write beyond buffer boundaries, potentially leading to privilege escalation or system compromise. It affects Bifrost, Valhall, and Arm 5th Gen GPU Architecture kernel drivers from versions r41p0 through r45p0.
💻 Affected Systems
- Arm Ltd Bifrost GPU Kernel Driver
- Arm Ltd Valhall GPU Kernel Driver
- Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level access, enabling full system compromise, data theft, or persistent malware installation.
Likely Case
Local privilege escalation allowing attackers to gain elevated privileges on affected systems.
If Mitigated
Limited impact if proper access controls restrict local user accounts and GPU driver permissions.
🎯 Exploit Status
Exploitation requires careful memory preparation by the attacker and depends on specific GPU driver configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after r45p0
Vendor Advisory: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
Restart Required: Yes
Instructions:
1. Check current Mali GPU driver version. 2. Update to version r46p0 or later from Arm's official sources. 3. Reboot the system to load the patched driver.
🔧 Temporary Workarounds
Restrict GPU driver access
linuxLimit access to GPU driver interfaces to reduce attack surface
chmod 600 /dev/mali0
chown root:root /dev/mali0
🧯 If You Can't Patch
- Restrict local user access to systems with vulnerable drivers
- Implement strict privilege separation and limit GPU driver permissions
🔍 How to Verify
Check if Vulnerable:
Check Mali GPU driver version: cat /sys/class/misc/mali0/device/driver/version or dmesg | grep -i maliCheck Version:
cat /sys/class/misc/mali0/device/driver/version 2>/dev/null || dmesg | grep -i 'mali.*driver.*version'Verify Fix Applied:
Verify driver version is r46p0 or later after update and reboot📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing memory access violations
- GPU driver crash logs
- Unexpected privilege escalation attempts
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
source="kernel" AND ("mali" OR "gpu") AND ("segfault" OR "oops" OR "access violation")