CVE-2024-1067
📋 TL;DR
A Use After Free vulnerability in Arm Mali GPU kernel drivers allows a local non-privileged user to perform improper GPU memory operations. On Armv8.0 cores with specific Linux Kernel and Mali driver configurations, this could allow GPU operations to affect other processes' userspace memory. This affects Bifrost, Valhall, and Arm 5th Gen GPU drivers from r41p0 through r47p0.
💻 Affected Systems
- Arm Ltd Bifrost GPU Kernel Driver
- Arm Ltd Valhall GPU Kernel Driver
- Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level access, potentially leading to full system compromise, data theft, or denial of service.
Likely Case
Local privilege escalation allowing attackers to gain elevated privileges and access sensitive data from other processes.
If Mitigated
Limited impact if proper access controls and isolation mechanisms are in place, though memory corruption risks remain.
🎯 Exploit Status
Requires local access and specific system configurations. Exploitation involves manipulating GPU memory operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after r47p0
Vendor Advisory: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
Restart Required: Yes
Instructions:
1. Check current Mali GPU driver version. 2. Update to version newer than r47p0 from Arm's official sources. 3. Reboot the system to load the updated driver.
🔧 Temporary Workarounds
Restrict local user access
linuxLimit local user accounts to trusted users only to reduce attack surface.
Disable vulnerable GPU features
linuxIf possible, disable or restrict GPU memory operations for non-privileged users.
🧯 If You Can't Patch
- Implement strict access controls to limit local user accounts to essential personnel only.
- Monitor system logs for unusual GPU memory operations or privilege escalation attempts.
🔍 How to Verify
Check if Vulnerable:
Check Mali GPU driver version and system configuration. Vulnerable if driver version is between r41p0 and r47p0 on Armv8.0 cores with specific Linux kernel configurations.Check Version:
Check /sys/module/mali/version or use modinfo mali | grep versionVerify Fix Applied:
Verify driver version is newer than r47p0 and check system logs for successful driver load after reboot.📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing memory corruption errors
- GPU driver crash logs
- Unexpected privilege escalation events
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Search for kernel panic logs, driver crash reports, or unexpected privilege changes from local users.