Arm’s Mali GPU driver flaws remain unpatched on Android devices

December 6, 2022 - TuxCare PR Team

Despite fixes released by the chipmaker, a set of five medium-severity security flaws in Arm’s Mali GPU driver have remained unpatched on Android devices such as Samsung, Oppo, Xiaomi, and Google for months.

One of the five vulnerabilities causes kernel memory corruption, another exposes physical addresses, and three cause a physical page use-after-free condition, allowing an attacker to read and write physical pages after they have been returned to the system. The vulnerabilities affect devices that use Arm’s Mali GPU, which means they affect the Google Pixel, Samsung Galaxy, and a plethora of other Android smartphones.

The flaws, which include a kernel memory corruption flaw, a physical address disclosure vulnerability, and a use-after-free bug, were discovered to have intersected with zero-days and exploit listings on the dark web.

In principle, these flaws could allow an attacker to read and write physical pages after they were returned to the system. In other words, an attacker with native code execution in an app could gain full access to the system and circumvent Android OS’s permission model.

Between July and August, Arm patched the five vulnerabilities, disclosed them as security issues on its vulnerabilities page, and published the patched drivers on their developer website. No major vendors had released patches as of yet. But Google has stated that the Arm-provided fix is currently being tested for Android and Pixel devices, and that it is expected to be released in the coming weeks. Other Android handset manufacturers must apply the patch in order to meet future security patch level (SPL) requirements.

Google Project Zero, a group of security analysts hired by Google LLC to find vulnerabilities, warns that Android phone manufacturers have failed to provide patches for several vulnerabilities discovered in the Mali graphics processing unit earlier this year.

Google says in a statement from the Android and Pixel teams that a fix for this exploit is currently in testing and will be available in the coming weeks. Android partners will also need to apply the patch.

The sources for this piece include an article in TheHackerNews.

Summary