Arm Mali GPU kernel driver: Use-after-free in the Bifrost/Valhall GPU kernel driver

Impact

Use-after-free in the Bifrost/Valhall GPU kernel driver - a local non-privileged user reaches freed kernel memory; exploited in the wild [KEV]

Who can reach it

Local user with GPU device access

What to do

Driver update + reboot. Not applicable to NVIDIA/AMD datacentre GPUs, but directly relevant to any Arm-based (Grace, Ampere Altra) node that ships a Mali display GPU, and it is the closest existing precedent for tenant-reachable GPU-driver privesc

References

Related entries

• Arm Mali GPU kernel driver: Use-after-free via improper GPU memory processingCVE-2023-4211 · Arm Mali GPU kernel driverMedium
• Linux kernel (drivers/gpu/drm/xe): The preempt-fence lock lives inside the exec queue, but the queue reference isCVE-2024-46683 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/pci): Pci_bus_lock() locked every device on the bus except the bridge itself, so a secondary busCVE-2024-46750 · Linux kernel (drivers/pci)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): Missing or insufficient validation of user-suppliedCVE-2024-46803 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel (drivers/gpu/drm/xe): The per-client memory accounting walks buffer-object state (TTM resource, tt pages)CVE-2024-46866 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The GPU VM is published into the id table before the create ioctl finishes with itCVE-2024-49865 · Linux kernel (drivers/gpu/drm/xe)High