Vulnerability-Lookup

CVE-2023-3889 (GCVE-0-2023-3889)

Vulnerability from cvelistv5 – Published: 2023-11-07 15:28 – Updated: 2025-12-16 18:13

Title

Mali GPU Kernel Driver exposes sensitive data from freed memory

Summary

A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2023-11-15 16:40 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-667 - Improper Locking

Assigner

Arm CNA under the mitre root

CNA scorecard D 54/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://developer.arm.com/Arm%20Security%20Center…

Impacted products

1 product

Vendor	Product	Version	CPE status
Arm Ltd	Valhall GPU Kernel Driver	Affected: r38p0 , ≤ r44p0 (patch)	guessed

Date Public

2023-11-07 11:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:08:50.619Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-3889",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-11-15T16:40:10.814759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T18:13:24.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Valhall GPU Kernel Driver",
          "vendor": "Arm Ltd",
          "versions": [
            {
              "changes": [
                {
                  "at": "r44p1",
                  "status": "unaffected"
                },
                {
                  "at": "r45p0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "r44p0",
              "status": "affected",
              "version": "r38p0",
              "versionType": "patch"
            }
          ]
        }
      ],
      "datePublic": "2023-11-07T11:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\u003c/p\u003e"
            }
          ],
          "value": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-667",
              "description": "CWE-667 Improper Locking",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-14T22:27:03.983Z",
        "orgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
        "shortName": "Arm"
      },
      "references": [
        {
          "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Mali GPU Kernel Driver exposes sensitive data from freed memory",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "arm-security@arm.com",
          "ID": "CVE-2023-3889",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Mali GPU Kernel Driver",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Midgard GPU Kernel  Driver"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Arm Ltd"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "5.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Mali GPU Kernel Driver allows improper GPU memory processing operations"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities",
              "refsource": "MISC",
              "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
    "assignerShortName": "Arm",
    "cveId": "CVE-2023-3889",
    "datePublished": "2023-11-07T15:28:43.500Z",
    "dateReserved": "2023-07-24T16:57:36.839Z",
    "dateUpdated": "2025-12-16T18:13:24.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-3889",
      "date": "2026-10-21",
      "epss": "0.00183",
      "percentile": "0.07484"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Valhall GPU Kernel Driver",
                "vendor": "Arm Ltd",
                "versions": [
                  {
                    "changes": [
                      {
                        "at": "r44p1",
                        "status": "unaffected"
                      },
                      {
                        "at": "r45p0",
                        "status": "unaffected"
                      }
                    ],
                    "lessThanOrEqual": "r44p0",
                    "status": "affected",
                    "version": "r38p0",
                    "versionType": "patch"
                  }
                ]
              }
            ],
            "source": "arm-security@arm.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "52E772F5-51AE-4ADC-A807-E98DECB1F2B1",
                    "versionEndIncluding": "r44p0",
                    "versionStartIncluding": "r38p0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\n\n"
          },
          {
            "lang": "es",
            "value": "Un usuario local sin privilegios puede realizar operaciones de procesamiento de memoria de GPU incorrectas. Si las operaciones se preparan cuidadosamente, podr\u00edan usarse para obtener acceso a la memoria ya liberada."
          }
        ],
        "id": "CVE-2023-3889",
        "lastModified": "2026-06-17T06:15:14.363",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-3889",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-11-15T16:40:10.814759Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-11-07T16:15:28.637",
        "references": [
          {
            "source": "arm-security@arm.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
          }
        ],
        "sourceIdentifier": "arm-security@arm.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-119"
              },
              {
                "lang": "en",
                "value": "CWE-667"
              }
            ],
            "source": "arm-security@arm.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-119"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-29T00:44:16+00:00",
      "cve": "CVE-2023-3889",
      "id": "CVE-2023-3889",
      "initial_release_date": "2023-11-07T11:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Mali GPU Kernel Driver exposes sensitive data from freed memory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-3889.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T07:08:50.619Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-3889",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2023-11-15T16:40:10.814759Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-24T17:59:55.681Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Valhall GPU Kernel Driver",
              "vendor": "Arm Ltd",
              "versions": [
                {
                  "changes": [
                    {
                      "at": "r44p1",
                      "status": "unaffected"
                    },
                    {
                      "at": "r45p0",
                      "status": "unaffected"
                    }
                  ],
                  "lessThanOrEqual": "r44p0",
                  "status": "affected",
                  "version": "r38p0",
                  "versionType": "patch"
                }
              ]
            }
          ],
          "datePublic": "2023-11-07T11:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\u003c/p\u003e"
                }
              ],
              "value": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\n\n"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-119",
                  "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-667",
                  "description": "CWE-667 Improper Locking",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-11-14T22:27:03.983Z",
            "orgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
            "shortName": "Arm"
          },
          "references": [
            {
              "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Mali GPU Kernel Driver exposes sensitive data from freed memory",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          },
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "arm-security@arm.com",
              "ID": "CVE-2023-3889",
              "STATE": "PUBLIC"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "Mali GPU Kernel Driver",
                          "version": {
                            "version_data": [
                              {
                                "version_value": "Midgard GPU Kernel  Driver"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "Arm Ltd"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "5.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory."
                }
              ]
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "Mali GPU Kernel Driver allows improper GPU memory processing operations"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities",
                  "refsource": "MISC",
                  "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
                }
              ]
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
        "assignerShortName": "Arm",
        "cveId": "CVE-2023-3889",
        "datePublished": "2023-11-07T15:28:43.500Z",
        "dateReserved": "2023-07-24T16:57:36.839Z",
        "dateUpdated": "2025-12-16T18:13:24.833Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2023-AVI-0995

Vulnerability from certfr_avis - Published: 2023-12-05 - Updated: 2023-12-11

De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Google	Android	Android versions 11 à 14 sans le dernier correctif de sécurité

References

Title

Publication Time

Tags

Bulletin de sécurité Android du 04 décembre 2023	None	vendor-advisory
Bulletin de sécurité Pixel du 06 décembre 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Android versions 11 \u00e0 14 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Android",
        "vendor": {
          "name": "Google",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-40090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40090"
    },
    {
      "name": "CVE-2023-21164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21164"
    },
    {
      "name": "CVE-2023-41111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41111"
    },
    {
      "name": "CVE-2023-28550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28550"
    },
    {
      "name": "CVE-2023-48415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48415"
    },
    {
      "name": "CVE-2023-48405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48405"
    },
    {
      "name": "CVE-2023-28587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28587"
    },
    {
      "name": "CVE-2023-35668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-35668"
    },
    {
      "name": "CVE-2023-21263",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21263"
    },
    {
      "name": "CVE-2022-48457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48457"
    },
    {
      "name": "CVE-2023-32847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32847"
    },
    {
      "name": "CVE-2023-48414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48414"
    },
    {
      "name": "CVE-2023-28580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28580"
    },
    {
      "name": "CVE-2023-33017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33017"
    },
    {
      "name": "CVE-2023-40078",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40078"
    },
    {
      "name": "CVE-2023-33063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33063"
    },
    {
      "name": "CVE-2023-33106",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33106"
    },
    {
      "name": "CVE-2023-33098",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33098"
    },
    {
      "name": "CVE-2023-32851",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32851"
    },
    {
      "name": "CVE-2023-28586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28586"
    },
    {
      "name": "CVE-2023-28588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28588"
    },
    {
      "name": "CVE-2023-48404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48404"
    },
    {
      "name": "CVE-2023-33081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33081"
    },
    {
      "name": "CVE-2023-21215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21215"
    },
    {
      "name": "CVE-2023-22668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22668"
    },
    {
      "name": "CVE-2023-33041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33041"
    },
    {
      "name": "CVE-2023-21402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21402"
    },
    {
      "name": "CVE-2023-28551",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28551"
    },
    {
      "name": "CVE-2023-40095",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40095"
    },
    {
      "name": "CVE-2023-48403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48403"
    },
    {
      "name": "CVE-2023-21664",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21664"
    },
    {
      "name": "CVE-2023-40098",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40098"
    },
    {
      "name": "CVE-2023-21228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21228"
    },
    {
      "name": "CVE-2023-40077",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40077"
    },
    {
      "name": "CVE-2023-33053",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33053"
    },
    {
      "name": "CVE-2023-48410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48410"
    },
    {
      "name": "CVE-2023-48416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48416"
    },
    {
      "name": "CVE-2022-40507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40507"
    },
    {
      "name": "CVE-2023-48423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48423"
    },
    {
      "name": "CVE-2023-40080",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40080"
    },
    {
      "name": "CVE-2023-21216",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21216"
    },
    {
      "name": "CVE-2023-33089",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33089"
    },
    {
      "name": "CVE-2023-40087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40087"
    },
    {
      "name": "CVE-2023-28579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28579"
    },
    {
      "name": "CVE-2023-37366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37366"
    },
    {
      "name": "CVE-2023-48401",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48401"
    },
    {
      "name": "CVE-2023-40075",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40075"
    },
    {
      "name": "CVE-2023-45773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45773"
    },
    {
      "name": "CVE-2023-48408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48408"
    },
    {
      "name": "CVE-2023-21403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21403"
    },
    {
      "name": "CVE-2023-28585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28585"
    },
    {
      "name": "CVE-2023-45866",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45866"
    },
    {
      "name": "CVE-2023-33107",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33107"
    },
    {
      "name": "CVE-2023-21217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21217"
    },
    {
      "name": "CVE-2023-48399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48399"
    },
    {
      "name": "CVE-2023-48409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48409"
    },
    {
      "name": "CVE-2023-4272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4272"
    },
    {
      "name": "CVE-2022-48454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48454"
    },
    {
      "name": "CVE-2022-22076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22076"
    },
    {
      "name": "CVE-2023-21218",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21218"
    },
    {
      "name": "CVE-2023-32818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32818"
    },
    {
      "name": "CVE-2023-48421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48421"
    },
    {
      "name": "CVE-2023-40081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40081"
    },
    {
      "name": "CVE-2023-33054",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33054"
    },
    {
      "name": "CVE-2023-21401",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21401"
    },
    {
      "name": "CVE-2023-40082",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40082"
    },
    {
      "name": "CVE-2023-48413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48413"
    },
    {
      "name": "CVE-2023-40079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40079"
    },
    {
      "name": "CVE-2023-48420",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48420"
    },
    {
      "name": "CVE-2023-32850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32850"
    },
    {
      "name": "CVE-2023-40103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40103"
    },
    {
      "name": "CVE-2023-48411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48411"
    },
    {
      "name": "CVE-2023-45774",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45774"
    },
    {
      "name": "CVE-2023-33080",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33080"
    },
    {
      "name": "CVE-2023-40089",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40089"
    },
    {
      "name": "CVE-2023-28546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28546"
    },
    {
      "name": "CVE-2023-45781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45781"
    },
    {
      "name": "CVE-2023-40094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40094"
    },
    {
      "name": "CVE-2023-3889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3889"
    },
    {
      "name": "CVE-2022-48455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48455"
    },
    {
      "name": "CVE-2023-40097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40097"
    },
    {
      "name": "CVE-2022-48459",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48459"
    },
    {
      "name": "CVE-2023-33024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33024"
    },
    {
      "name": "CVE-2023-28575",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28575"
    },
    {
      "name": "CVE-2023-48412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48412"
    },
    {
      "name": "CVE-2023-33097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33097"
    },
    {
      "name": "CVE-2023-21662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21662"
    },
    {
      "name": "CVE-2023-21394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21394"
    },
    {
      "name": "CVE-2023-40084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40084"
    },
    {
      "name": "CVE-2023-33088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33088"
    },
    {
      "name": "CVE-2023-33018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33018"
    },
    {
      "name": "CVE-2022-48461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48461"
    },
    {
      "name": "CVE-2023-21267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21267"
    },
    {
      "name": "CVE-2023-40092",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40092"
    },
    {
      "name": "CVE-2023-22383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22383"
    },
    {
      "name": "CVE-2023-40074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40074"
    },
    {
      "name": "CVE-2023-48406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48406"
    },
    {
      "name": "CVE-2023-35690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-35690"
    },
    {
      "name": "CVE-2023-33087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33087"
    },
    {
      "name": "CVE-2023-21652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21652"
    },
    {
      "name": "CVE-2023-48422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48422"
    },
    {
      "name": "CVE-2023-45777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45777"
    },
    {
      "name": "CVE-2023-33022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33022"
    },
    {
      "name": "CVE-2022-48458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48458"
    },
    {
      "name": "CVE-2023-21162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21162"
    },
    {
      "name": "CVE-2023-33092",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33092"
    },
    {
      "name": "CVE-2023-40076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40076"
    },
    {
      "name": "CVE-2023-40073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40073"
    },
    {
      "name": "CVE-2023-32848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32848"
    },
    {
      "name": "CVE-2023-40096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40096"
    },
    {
      "name": "CVE-2023-45775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45775"
    },
    {
      "name": "CVE-2023-48397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48397"
    },
    {
      "name": "CVE-2023-40088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40088"
    },
    {
      "name": "CVE-2023-21166",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21166"
    },
    {
      "name": "CVE-2023-21227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21227"
    },
    {
      "name": "CVE-2023-32804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32804"
    },
    {
      "name": "CVE-2023-21163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21163"
    },
    {
      "name": "CVE-2023-33079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33079"
    },
    {
      "name": "CVE-2023-45776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45776"
    },
    {
      "name": "CVE-2023-21634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21634"
    },
    {
      "name": "CVE-2023-45779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45779"
    },
    {
      "name": "CVE-2023-48398",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48398"
    },
    {
      "name": "CVE-2023-40083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40083"
    },
    {
      "name": "CVE-2023-40091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40091"
    },
    {
      "name": "CVE-2023-48402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48402"
    },
    {
      "name": "CVE-2023-48407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48407"
    },
    {
      "name": "CVE-2022-48456",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48456"
    }
  ],
  "initial_release_date": "2023-12-05T00:00:00",
  "last_revision_date": "2023-12-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0995",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-05T00:00:00.000000"
    },
    {
      "description": "Ajout du bulletin de s\u00e9curit\u00e9 Pixel du 06 d\u00e9cembre 2023.",
      "revision_date": "2023-12-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Android du 04 d\u00e9cembre 2023",
      "url": "https://source.android.com/docs/security/bulletin/2023-12-01?hl=fr"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Pixel du 06 d\u00e9cembre 2023",
      "url": "https://source.android.com/docs/security/bulletin/pixel/2023-12-01?hl=fr"
    }
  ]
}

FKIE_CVE-2023-3889

Vulnerability from fkie_nvd - Published: 2023-11-07 16:15 - Updated: 2026-06-17 06:15

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.

References

	URL	Tags
	arm-security@arm.com	https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities	Vendor Advisory

Impacted products

	Vendor	Product	Version
	arm	valhall_gpu_kernel_driver	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Valhall GPU Kernel Driver",
          "vendor": "Arm Ltd",
          "versions": [
            {
              "changes": [
                {
                  "at": "r44p1",
                  "status": "unaffected"
                },
                {
                  "at": "r45p0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "r44p0",
              "status": "affected",
              "version": "r38p0",
              "versionType": "patch"
            }
          ]
        }
      ],
      "source": "arm-security@arm.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "52E772F5-51AE-4ADC-A807-E98DECB1F2B1",
              "versionEndIncluding": "r44p0",
              "versionStartIncluding": "r38p0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\n\n"
    },
    {
      "lang": "es",
      "value": "Un usuario local sin privilegios puede realizar operaciones de procesamiento de memoria de GPU incorrectas. Si las operaciones se preparan cuidadosamente, podr\u00edan usarse para obtener acceso a la memoria ya liberada."
    }
  ],
  "id": "CVE-2023-3889",
  "lastModified": "2026-06-17T06:15:14.363",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-3889",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2023-11-15T16:40:10.814759Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-11-07T16:15:28.637",
  "references": [
    {
      "source": "arm-security@arm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
    }
  ],
  "sourceIdentifier": "arm-security@arm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        },
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ],
      "source": "arm-security@arm.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-4QP7-687G-H58J

Vulnerability from github – Published: 2023-11-14 12:30 – Updated: 2023-11-14 21:30

Details

A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-3889"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-07T16:15:28Z",
    "severity": "HIGH"
  },
  "details": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\n\n",
  "id": "GHSA-4qp7-687g-h58j",
  "modified": "2023-11-14T21:30:54Z",
  "published": "2023-11-14T12:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3889"
    },
    {
      "type": "WEB",
      "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-3889

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.

Aliases

CVE-2023-3889

Aliases

CVE-2023-3889

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-3889",
    "id": "GSD-2023-3889"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-3889"
      ],
      "details": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\n\n",
      "id": "GSD-2023-3889",
      "modified": "2023-12-13T01:20:55.284102Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "arm-security@arm.com",
        "ID": "CVE-2023-3889",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Valhall GPU Kernel Driver",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "changes": [
                                  {
                                    "at": "r44p1",
                                    "status": "unaffected"
                                  },
                                  {
                                    "at": "r45p0",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThanOrEqual": "r44p0",
                                "status": "affected",
                                "version": "r38p0",
                                "versionType": "patch"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Arm Ltd"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-119",
                "lang": "eng",
                "value": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"
              }
            ]
          },
          {
            "description": [
              {
                "cweId": "CWE-667",
                "lang": "eng",
                "value": "CWE-667 Improper Locking"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities",
            "refsource": "MISC",
            "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
          }
        ]
      },
      "source": {
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "r44p0",
                "versionStartIncluding": "r38p0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "arm-security@arm.com",
          "ID": "CVE-2023-3889"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.\n\n"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities",
              "refsource": "",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-11-14T20:20Z",
      "publishedDate": "2023-11-07T16:15Z"
    }
  }
}

WID-SEC-W-2023-3057

Vulnerability from csaf_certbund - Published: 2023-12-04 23:00 - Updated: 2023-12-06 23:00

Summary

Google Android: Mehrere Schwachstellen

Severity

Hoch

Scope

94 vulnerabilities in this advisory, including CVE-2023-3889.

CVE-2023-3889

Es bestehen mehrere Schwachstellen in Google Android. Diese Fehler bestehen in mehreren Komponenten aufgrund mehrerer Sicherheitsprobleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand auszulösen, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern. Einige der Schwachstellen erfordern eine Benutzerinteraktion, um sie erfolgreich auszunutzen.

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-3889 (GCVE-0-2023-3889)

CERTFR-2023-AVI-0995

Solution

FKIE_CVE-2023-3889

GHSA-4QP7-687G-H58J

GSD-2023-3889

WID-SEC-W-2023-3057

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour