CVE-2023-4272: Arm Bifrost GPU Use-After-Free Vulnerability

CVE-2023-4272 Overview

CVE-2023-4272 is an information disclosure vulnerability in the Arm Mali GPU kernel driver family. A local non-privileged user can issue GPU processing operations that expose sensitive data residing in previously freed memory. The flaw affects the Midgard, Bifrost, Valhall, and Arm 5th Gen GPU architectures shipped on a wide range of Android devices and embedded Linux systems.

Arm tracks this issue under its Mali GPU Driver Vulnerabilities advisory and classifies it under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. The weakness allows attackers with code execution on the device to read residual kernel or other process data through crafted GPU workloads.

Critical Impact
A local non-privileged user can recover sensitive data from freed memory regions via GPU processing operations, enabling secondary attacks such as credential theft or kernel address disclosure.

Affected Products

Arm Midgard GPU Kernel Driver
Arm Bifrost GPU Kernel Driver
Arm Valhall GPU Kernel Driver
Arm Mali GPU Kernel Driver (r41p0)

Discovery Timeline

2023-11-07 - CVE-2023-4272 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-4272

Vulnerability Analysis

The vulnerability resides in the Mali GPU kernel driver, which mediates memory and command submission between user-space GPU clients and the GPU hardware. When the driver allocates or recycles memory backing GPU operations, it fails to fully sanitize the contents of pages that were previously freed. A local attacker can submit GPU processing commands that observe the residual contents of those pages.

The exposed data can include remnants of kernel structures, other process buffers, or sensitive material such as cryptographic keys and authentication tokens. While exploitation does not directly grant code execution, the disclosed information can be chained with other primitives to defeat kernel address space layout randomization (KASLR) or to mount targeted privilege escalation attacks.

This class of issue has historically appeared across multiple Mali driver generations, reflecting shared memory management code between the Midgard, Bifrost, and Valhall driver branches.

Root Cause

The root cause is improper sanitization of memory before it is reused or exposed to user-controlled GPU operations. The driver returns previously allocated memory to a free pool and later re-issues those pages for GPU access without zeroing them. Because GPU workloads execute under the requesting user's context, the contents of those pages become observable to a non-privileged caller.

Attack Vector

An attacker requires local access and the ability to run an unprivileged process that can open the Mali GPU device node, typically /dev/mali0. On Android, this is reachable from any application sandbox because GPU access is granted to standard apps. The attacker allocates GPU memory regions, triggers operations that cause the driver to map or process freed pages, and reads the residual data through standard GPU buffer interfaces.

No network access, user interaction, or elevated privileges are required. The vulnerability is information disclosure only and does not directly impact integrity or availability.

No verified public proof-of-concept code is available for this CVE. Refer to the Arm Security Center Mali GPU Driver Vulnerabilities advisory for vendor technical details.

Detection Methods for CVE-2023-4272

Indicators of Compromise

Unprivileged processes opening /dev/mali0 and issuing high volumes of GPU memory allocation and free operations.
Unexpected user-space binaries on Android or embedded Linux devices interacting with the Mali ioctl interface outside of normal graphics or compute workloads.
Anomalous GPU memory mapping patterns from non-graphics applications, particularly background services or recently installed apps.

Detection Strategies

Monitor ioctl calls against the Mali device node and baseline expected callers such as SurfaceFlinger, HWUI, and known compute frameworks.
Use Linux audit rules or eBPF probes to flag non-graphics processes performing repeated KBASE_IOCTL_MEM_ALLOC and free sequences.
Correlate GPU driver telemetry with application install events to identify newly installed software probing the GPU subsystem.

Monitoring Recommendations

Track kernel driver versions across the device fleet and alert when devices remain on Mali driver versions predating Arm's fix.
Aggregate process and syscall telemetry into a centralized data lake to support retrospective hunting for GPU-based information disclosure patterns.
Review mobile device management (MDM) reports for vendor security patch level to confirm Arm Mali fixes are deployed.

How to Mitigate CVE-2023-4272

Immediate Actions Required

Apply the latest Mali GPU kernel driver release from Arm or the device's silicon vendor and OEM as soon as it is available.
Update Android devices to the security patch level that includes the Arm Mali fix, distributed through the monthly Android Security Bulletins.
Restrict installation of untrusted applications on affected devices, since local code execution is the precondition for exploitation.

Patch Information

Arm has issued fixed releases of the Midgard, Bifrost, Valhall, and Arm 5th Gen GPU kernel drivers. The corrected versions are documented in the Arm Security Center Mali GPU Driver Vulnerabilities advisory. Device vendors integrate these driver updates into their kernel builds and ship them through OEM firmware updates.

Workarounds

No supported workaround replaces the vendor patch. Where patching is delayed, limit device exposure by enforcing application allowlisting and removing unused apps with GPU access.
On managed Android fleets, enforce MDM policies that block sideloading and require devices to remain on the current security patch level.
For Linux-based embedded systems, restrict access to /dev/mali* device nodes to trusted user accounts and services where the deployment model allows.