CVE-2022-22706 Arm Mali GPU Kernel Driver Unspecified
A non-privileged user can exploit a memory corruption flaw in the Arm Mali GPU driver to write to read-only memory, potentially escalating privileges or executing code.
- Exploited in the wild
- Since 30 Mar 2023
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-22706?
CVE-2022-22706 is a high-severity memory corruption vulnerability in Arm Valhall Gpu Kernel Driver, published on 3 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 through r35p0.
Weakness: CWE-119
Which versions are affected by CVE-2022-22706?
It affects 3 products.
Products include Arm Bifrost Gpu Kernel Driver, Arm Midgard Gpu Kernel Driver, Arm Valhall Gpu Kernel Driver.
How do I fix CVE-2022-22706?
Apply the vendor's patch. US federal agencies must fix it by 20 Apr 2023.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-22706 being exploited?
Yes. Attackers have exploited CVE-2022-22706 in the wild since at least 30 Mar 2023.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Arm Valhall Gpu Kernel Driver
- CVE-2022-38181 Arm Mali GPU Kernel Driver Use-After-Free
- CVE-2021-29256 Arm Mali GPU Kernel Driver Use-After-Free
- CVE-2021-28663 Arm Mali Graphics Processing Unit (GPU) Use-After-Free
- CVE-2021-28664 Arm Mali Graphics Processing Unit (GPU) Unspecified
- CVE-2024-4610 Arm Mali GPU Kernel Driver Use-After-Free
Sources
Also known as A-225040268, ASB-A-225040268, GHSA-fjww-grc5-6wh6.