Arm Mali GPU CVE-2023-4211: Exploited Kernel Driver UAF

What to do

1. Pull the security patch level of every managed Android device and list Mali-based devices below 2023-10-05.
2. Block corporate access from devices below that patch level until they update.
3. Retire devices that no longer receive security updates, and any device with a Midgard (Mali-T series) GPU, which has no fix.
4. For embedded Linux products with Mali GPUs, ask the SoC or board vendor to confirm the kernel driver is r43p0 or later.
5. Keep the minimum allowed patch level rolling forward; this bug sat fixed in Arm's driver for months before phones received it.

How to check if you are affected or compromised

• Check the patch level with adb shell getprop ro.build.version.security_patch, and the GPU with adb shell getprop ro.hardware.egl (typically mali on Mali devices).
• Arm and Google published no indicators of compromise; a current patch level is the main signal.
• For high-risk users whose devices lagged on patches in 2023, arrange a professional mobile forensic review instead of relying on on-device checks.

What happened#

On October 2, 2023, Arm disclosed CVE-2023-4211, a use-after-free in its Mali GPU kernel driver. Arm said the flaw "may be under limited, targeted exploitation." The same day, Google's Android Security Bulletin for October 2023 noted "indications" of limited, targeted exploitation. CISA added the CVE to the KEV catalog on October 3, with an October 24 deadline. Maddie Stone of Google's Threat Analysis Group and Jann Horn of Google Project Zero reported it.

Google's root-cause analysis traces the flaw to the driver's handling of a "tracking page" memory mapping. Before r43, a process could split that mapping, fork, and race the two processes. The driver then did bookkeeping on another process's memory descriptor after it had been freed. Any app that can open /dev/mali0 can reach the bug. On Android that includes an ordinary installed app, or code already running inside a compromised one. Google had the exploit sample but has not named the attacker. Help Net Security notes that two earlier Mali zero-days were used to deliver spyware from the commercial vendor Variston.

Who is affected#

Per Arm's CVE record:

• Bifrost r0p0–r42p0, Valhall r19p0–r42p0 and Arm 5th Gen r41p0–r42p0 are affected. All are fixed in r43p0, which BleepingComputer says Arm released on March 24, 2023.
• Midgard r12p0–r32p0 is affected with no fixed release. Arm told Midgard customers to contact Arm support.

Mali GPUs ship in many Android phones and tablets and in other Arm-based devices. BleepingComputer listed Mali-G77 phones such as the Samsung Galaxy S20 and S20 FE, Xiaomi Redmi K30 and K40, Motorola Edge 40 and OnePlus Nord 2 as examples. On Android, the fix is in security patch level 2023-10-05 and later.

Do you really need to act?#

For a supported, updated phone, no. Three years of monthly patches cover it. NVD scores it CVSS 3.1 5.5 because it is local, but Android rates it High. In practice, Mali driver bugs have served as the kernel step in spyware chains.

The bug also shows the gap. Arm's fixed driver was out in March 2023, yet phones got it only with the October patch level. Devices that stopped receiving updates before then are still exposed: out-of-support models, cheap tablets, TV boxes and rugged or kiosk devices. Midgard-based hardware never got a fix at all.

What to do now#

1. Pull patch levels from your MDM, or per device run adb shell getprop ro.build.version.security_patch. Flag anything below 2023-10-05.
2. Find Mali devices. adb shell getprop ro.hardware.egl typically returns mali, and adb shell dumpsys SurfaceFlinger | grep -i GLES shows the GPU model and driver string.
3. Block corporate access from devices below 2023-10-05 until they update. Retire models that no longer get updates.
4. Retire devices with Midgard (Mali-T series) GPUs. No fix exists.
5. For embedded Linux products with Mali GPUs, ask the SoC or board vendor to confirm the kernel driver is r43p0 or later.

How to tell if you were hit#

Arm and Google published no indicators of compromise. Exploitation was targeted, and the bug alone needs code already running on the device, so there is little to see on the network. A current patch level is the main check. For high-risk users whose phones were unpatched in 2023, such as executives, journalists and activists, arrange a professional mobile forensic review rather than relying on on-device checks.

Timeline#

• Mar 24, 2023 — Arm releases Mali driver r43p0, which fixes the bug for Bifrost, Valhall and 5th Gen GPUs.
• Oct 2, 2023 — Arm discloses CVE-2023-4211 and reports possible targeted exploitation. The Android Security Bulletin ships the fix at patch level 2023-10-05.
• Oct 3, 2023 — CISA adds CVE-2023-4211 to KEV.
• Oct 24, 2023 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2023-4211 · KEV 2023-10-03 · A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE record — CVE-2023-4211 (Arm) cve.org
2. Android — Android Security Bulletin, October 2023 source.android.com
3. Google Project Zero — CVE-2023-4211: Use-after-Free in ARM Mali GPU Driver googleprojectzero.github.io
4. NVD — CVE-2023-4211 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2023-4211 cisa.gov

Coverage and analysis

1. BleepingComputer — Arm warns of Mali GPU flaws likely exploited in targeted attacks bleepingcomputer.com
2. Help Net Security — Zero-day in Arm GPU drivers exploited in targeted attacks (CVE-2023-4211) helpnetsecurity.com