{"id":"CVE-2023-4211","aliases":["A-294605494","ASB-A-294605494","EUVD-2023-54085","GHSA-7537-p54v-mh3v","PUB-A-294605494"],"status":"published","title":"Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations","description":"A local non-privileged user can make improper GPU memory processing operations  to gain access to already freed memory.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00969,"percentile":0.62298,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2023-09-01T00:00:00Z","modified":"2026-11-02T16:38:00Z","kev":{"date_added":"2023-10-03","due_date":"2023-10-24","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-10-03"},{"source":"kev","since":"2023-10-03"}],"fixes":[{"ecosystem":"Android","package":":unknown:","fixed_in":["SoCVersion:2023-10-05","SoCVersion:2023-09-05"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":":unknown:","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"SoCVersion:0"},{"fixed":"SoCVersion:2023-10-05"}]}],"versions":["SoCVersion"]},{"source":"osv","ecosystem":"Android","package":":unknown:","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"SoCVersion:0"},{"fixed":"SoCVersion:2023-09-05"}]}],"versions":["SoCVersion"]}],"products":[{"vendor":"arm","product":"5th_gen_gpu_architecture_kernel_driver"},{"vendor":"arm","product":"bifrost_gpu_kernel_driver"},{"vendor":"arm","product":"mali gpu kernel driver"},{"vendor":"arm","product":"midgard_gpu_kernel_driver"},{"vendor":"arm","product":"valhall_gpu_kernel_driver"},{"vendor":"arm ltd","product":"arm 5th gen gpu architecture kernel  driver"},{"vendor":"arm ltd","product":"bifrost gpu kernel driver"},{"vendor":"arm ltd","product":"midgard gpu kernel driver"},{"vendor":"arm ltd","product":"valhall gpu kernel driver"}],"references":[{"url":"https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities","tags":["x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4211","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4211"},{"url":"https://chromereleases.googleblog.com/2023/08/long-term-support-channel-update-for_23.html"},{"url":"https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-chromeos_25.html"},{"url":"https://source.android.com/docs/security/bulletin/pixel/2023-09-01"},{"url":"https://arstechnica.com/security/2023/10/vulnerable-arm-gpu-drivers-under-active-exploitation-patches-may-not-be-available"},{"url":"https://www.bleepingcomputer.com/news/security/arm-warns-of-mali-gpu-flaws-likely-exploited-in-targeted-attacks"},{"url":"https://github.com/advisories/GHSA-7537-p54v-mh3v"},{"url":"https://source.android.com/security/bulletin/2023-10-01","tags":["advisory"]},{"url":"https://source.android.com/security/bulletin/2023-09-01","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4211","title":"Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations","description":"A local non-privileged user can make improper GPU memory processing operations  to gain access to already freed memory.","status":"published","published":"2023-10-01T17:00:27.113Z","modified":"2025-10-21T23:05:36.029Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:35:30.474787Z"}],"euvd":[{"id":"EUVD-2023-54085","description":"A local non-privileged user can make improper GPU memory processing operations  to gain access to already freed memory.","status":"published","published":"2023-10-01T17:00:27Z","modified":"2025-10-21T23:05:36Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"exploited_since":"2023-10-03","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-7537-p54v-mh3v","title":"A local non-privileged user can make improper GPU memory processing operations  to gain access to...","description":"A local non-privileged user can make improper GPU memory processing operations  to gain access to already freed memory.","status":"published","published":"2023-10-01T18:31:18Z","modified":"2025-10-22T00:32:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2023-4211","title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability","description":"Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.","cwes":["CWE-416"],"kev":{"date_added":"2023-10-03","due_date":"2023-10-24","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-4211","description":"A local non-privileged user can make improper GPU memory processing operations  to gain access to already freed memory.","status":"published","published":"2023-10-01T18:15:09.927Z","modified":"2026-06-17T06:37:19.41Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:08:35.022405Z"}],"osv":[{"id":"ASB-A-294605494","status":"published","published":"2023-10-01T00:00:00Z","modified":"2026-11-10T17:02:23.040266809Z","updated_at":"2026-11-10T17:35:05.865114Z"},{"id":"PUB-A-294605494","status":"published","published":"2023-09-01T00:00:00Z","modified":"2026-11-11T16:12:36.322289056Z","updated_at":"2026-11-10T17:35:08.76702Z"}]}}