CVE-2023-6143
📋 TL;DR
A use-after-free vulnerability in Arm Mali GPU kernel drivers allows local non-privileged users to exploit a race condition under heavy system load to perform improper memory operations. This could lead to privilege escalation or system instability. Affects multiple Arm GPU driver families across specific version ranges.
💻 Affected Systems
- Arm Midgard GPU Kernel Driver
- Arm Bifrost GPU Kernel Driver
- Arm Valhall GPU Kernel Driver
- Arm 5th Gen GPU Architecture Kernel Driver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level access, potentially leading to full system compromise, data theft, or persistent malware installation.
Likely Case
Local privilege escalation allowing attackers to gain elevated privileges on the affected system, potentially leading to further lateral movement.
If Mitigated
Denial of service or application crashes if exploitation attempts fail or are detected by security controls.
🎯 Exploit Status
Exploitation requires local access, careful memory preparation, and heavy system load to trigger the race condition reliably.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions beyond the affected ranges: Midgard > r32p0, Bifrost > r18p0, Valhall > r46p0, 5th Gen > r46p0
Vendor Advisory: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
Restart Required: Yes
Instructions:
1. Check current driver version. 2. Update to patched driver version from Arm or device manufacturer. 3. Reboot system to load new driver. 4. Verify driver version post-update.
🔧 Temporary Workarounds
Restrict local user access
allLimit local user accounts and implement strict access controls to reduce attack surface.
Monitor system load
linuxImplement monitoring for abnormal system load patterns that could indicate exploitation attempts.
🧯 If You Can't Patch
- Implement strict local access controls and least privilege principles
- Deploy endpoint detection and response (EDR) solutions to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check GPU driver version via: cat /sys/kernel/debug/mali0/version or similar driver-specific locationCheck Version:
cat /sys/kernel/debug/mali0/version 2>/dev/null || dmesg | grep -i maliVerify Fix Applied:
Verify driver version is outside affected ranges after update using same version check command📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- GPU driver crash messages
- Abnormal memory access patterns in kernel logs
Network Indicators:
- None - local exploitation only
SIEM Query:
source="kernel" AND ("mali" OR "gpu") AND ("panic" OR "crash" OR "use-after-free")