ClickCease Arm’s Mali GPU driver flaws remain unpatched on Android devices

Join Our Popular Newsletter

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.

Arm’s Mali GPU driver flaws remain unpatched on Android devices

Obanla Opeyemi

December 6, 2022 - TuxCare expert team

Despite fixes released by the chipmaker, a set of five medium-severity security flaws in Arm’s Mali GPU driver have remained unpatched on Android devices such as Samsung, Oppo, Xiaomi, and Google for months.

One of the five vulnerabilities causes kernel memory corruption, another exposes physical addresses, and three cause a physical page use-after-free condition, allowing an attacker to read and write physical pages after they have been returned to the system. The vulnerabilities affect devices that use Arm’s Mali GPU, which means they affect the Google Pixel, Samsung Galaxy, and a plethora of other Android smartphones.

The flaws, which include a kernel memory corruption flaw, a physical address disclosure vulnerability, and a use-after-free bug, were discovered to have intersected with zero-days and exploit listings on the dark web.

In principle, these flaws could allow an attacker to read and write physical pages after they were returned to the system. In other words, an attacker with native code execution in an app could gain full access to the system and circumvent Android OS’s permission model.

Between July and August, Arm patched the five vulnerabilities, disclosed them as security issues on its vulnerabilities page, and published the patched drivers on their developer website. No major vendors had released patches as of yet. But Google has stated that the Arm-provided fix is currently being tested for Android and Pixel devices, and that it is expected to be released in the coming weeks. Other Android handset manufacturers must apply the patch in order to meet future security patch level (SPL) requirements.

Google Project Zero, a group of security analysts hired by Google LLC to find vulnerabilities, warns that Android phone manufacturers have failed to provide patches for several vulnerabilities discovered in the Mali graphics processing unit earlier this year.

Google says in a statement from the Android and Pixel teams that a fix for this exploit is currently in testing and will be available in the coming weeks. Android partners will also need to apply the patch.

The sources for this piece include an article in TheHackerNews.

Summary
Arm’s Mali GPU driver flaws remain unpatched on Android devices
Article Name
Arm’s Mali GPU driver flaws remain unpatched on Android devices
Description
Despite fixes released, a set of five medium-severity security flaws in Arm's Mali GPU driver have remained unpatched on Android devices.
Author
Publisher Name
TuxCare
Publisher Logo

Looking to automate vulnerability patching without kernel reboots, system downtime, or scheduled maintenance windows?

Learn About Live Patching with TuxCare

Related Articles

How GPT models can be...

According to CyberArk researchers, GPT-based models like ChatGPT can be...

January 30, 2023

Attackers actively exploit Unpatched Control...

Malicious hackers have started exploiting a critical vulnerability CVE-2022-44877 in...

January 27, 2023

Attackers distribute malware via malicious...

Deep Instinct researchers reported that RATs like StrRAT and Ratty...

January 26, 2023

CircleCI partners AWS to identify...

According to CircleCI’s CTO, Rob Zuber, CircleCI is working with...

January 25, 2023

Cisco warns of authentication bypass...

A remote attacker could exploit multiple vulnerabilities in four Cisco...

January 24, 2023

IceID malware infiltrates Active Directory...

In a notable IcedID malware attack, the assailant impacted the...

January 23, 2023