CVE-2025-0015
📋 TL;DR
A Use After Free vulnerability in Arm's Valhall and 5th Gen GPU kernel drivers allows local non-privileged users to access freed memory through improper GPU operations. This affects devices with specific Arm GPU driver versions, potentially leading to privilege escalation or system compromise.
💻 Affected Systems
- Arm Ltd Valhall GPU Kernel Driver
- Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver
📦 What is this software?
5th Gen Gpu Architecture Kernel Driver by Arm
View all CVEs affecting 5th Gen Gpu Architecture Kernel Driver →
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level access, allowing full system compromise, data theft, or persistence mechanisms installation.
Likely Case
Local privilege escalation enabling unauthorized access to sensitive data or system resources.
If Mitigated
Limited impact if proper access controls restrict local user accounts and GPU operations are monitored.
🎯 Exploit Status
Requires local access and knowledge of GPU driver internals. No public exploit code known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after r49p1 for r48-r49 series, after r52p0 for r50-r52 series
Vendor Advisory: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
Restart Required: No
Instructions:
1. Check current GPU driver version. 2. Obtain updated driver from device manufacturer or Arm. 3. Apply driver update following vendor instructions. 4. Verify update applied successfully.
🔧 Temporary Workarounds
Restrict GPU access
LinuxLimit non-privileged user access to GPU operations through system permissions
chmod 750 /dev/mali0
setfacl -m u:user:r-- /dev/mali0
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor system logs for unusual GPU driver activity or privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check GPU driver version via 'cat /sys/class/misc/mali0/device/driver/version' or vendor-specific commandsCheck Version:
cat /sys/class/misc/mali0/device/driver/version 2>/dev/null || echo 'Driver not found'Verify Fix Applied:
Verify driver version is outside affected ranges: not between r48p0-r49p1 or r50p0-r52p0📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages related to GPU driver
- Unusual privilege escalation attempts from local users
- GPU driver crash logs
Network Indicators:
- None - local exploitation only
SIEM Query:
source="kernel" AND ("mali" OR "gpu") AND ("panic" OR "oops" OR "segfault")