{"id":"CVE-2023-4211","kind":"vulnerability","aliases":["CVE-2023-4211"],"related":[],"title":"A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory","description":"Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Arm Mali GPU kernel driver has a use-after-free bug in GPU memory handling. A local, unprivileged user can access memory that was already freed, which can lead to privilege escalation on the device.","severity":"high","cvss":5.5,"epss":null,"exploited":true,"exploited_at":"2023-10-03T00:00:00+00:00","products":[{"name":"Arm Mali GPU Kernel Driver","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"arm 5th gen gpu architecture kernel driver","fixed":["r43p0"],"affected":">= r41p0, < r43p0","ecosystem":"vendor"},{"name":"arm bifrost gpu kernel driver","fixed":["r43p0"],"affected":">= r0p0, < r43p0","ecosystem":"vendor"},{"name":"arm midgard gpu kernel driver","fixed":[],"affected":">= r12p0, <= r32p0","ecosystem":"vendor"},{"name":"arm valhall gpu kernel driver","fixed":["r43p0"],"affected":">= r19p0, < r43p0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","arm-mali","embedded","exploited","infrastructure","linux"],"not_affected_if":["no-mali-gpu","patched-driver"],"how_to_check":null,"fix":"Apply the vendor mitigation per Arm's instructions, or stop using the affected driver if no mitigation exists. Specific fixed driver versions: unknown.","status":"open","published_at":"2023-10-01T18:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:31+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:04:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per Arm's instructions, or stop using the affected driver if no mitigation exists. Specific fixed driver versions: unknown.","reach":"local","impact":"high","summary":"Arm Mali GPU kernel driver has a use-after-free bug in GPU memory handling. A local, unprivileged user can access memory that was already freed, which can lead to privilege escalation on the device.","category":"infrastructure","who_cares":["android","linux","arm-mali","embedded"],"confidence":0.7,"needs_auth":"yes","worst_case":"local unprivileged user reads freed kernel memory, escalating privileges","analyst_note":"Find Arm's security bulletin for CVE-2023-4211 to get affected driver versions and fixed releases; CISA KEV entry confirms exploitation in the wild.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-mali-gpu","patched-driver"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2847,"output_tokens":371,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':22A,25A '-4211':23A,26A '5th':33A 'access':16A,83B,127C 'action':134C 'allow':111C 'alreadi':18A,87B,129C 'android':54B 'appli':135C 'architecture':36A 'arm':27A,32A,39A,44A,49A,56B,62B,98C 'arm-mali':55B 'bifrost':40A 'bug':73B 'cisa':132C 'contain':103C 'cve':21A,24A 'devic':97B 'discontinu':141C 'driver':31A,38A,43A,48A,53A,66B,102C 'embed':58B 'escal':94B 'exploit':59B 'free':72B,108C 'freed':19A,88B,130C 'gain':15A,126C 'gen':34A 'gpu':10A,29A,35A,41A,46A,51A,64B,75B,100C,121C 'handl':77B 'improp':9A,120C 'infrastructur':60B 'instruct':139C 'kernel':30A,37A,42A,47A,52A,65B,101C 'lead':91B 'linux':61B 'local':2A,79B,113C 'make':8A,119C 'mali':28A,57B,63B,99C 'memori':11A,20A,76B,84B,122C,131C 'midgard':45A 'mitig':136C,147C 'non':4A,115C 'non-privileg':3A,114C 'oper':13A,124C 'per':137C 'privileg':5A,93B,116C 'process':12A,123C 'product':145C 'requir':133C 'unavail':149C 'unprivileg':80B 'use':70B,106C,142C 'use-after-fre':69B,105C 'user':6A,81B,117C 'valhall':50A 'vendor':138C 'vulner':109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-10-01T18:15:09+00:00","kev":{"dateAdded":"2023-10-03","dueDate":"2023-10-24","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-4211","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4211","severity":null,"published_at":"2023-10-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T21:35:48+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-4211","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4211","severity":null,"published_at":"2023-10-01T18:15:09+00:00","modified_at":"2026-06-17T06:37:19+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}