External risk intelligence

Arm Mali GPU Driver Information Disclosure.

CVE advisoryKnown Exploit

CVE-2023-26083

This vulnerability resides within the GPU kernel driver, which requires local, low-privileged access to the device to execute processing operations. It is not reachable via network protocols or public-facing internet services.

Arm 5th Gen Gpu Architecture Kernel Driver

r41p0 to before r43p0r0p0 to before r43p0r6p0 to r32p0r19p0 to before r43p0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The Arm Mali GPU Kernel Driver is susceptible to a memory leak vulnerability. This flaw permits an unauthorized user to execute standard GPU operations that can expose sensitive information from the system's kernel. This could lead to unauthorized access to internal system data.

Vulnerable component: Arm Mali GPU Kernel Driver
Core weakness: Memory leak exposes kernel metadata
Main business impact: Unauthorized access to sensitive data

Attack Path

How an attacker could exploit the issue

A memory leak vulnerability exists in the Mali GPU Kernel Driver. This issue allows a local, non-privileged user to perform specific GPU operations. These operations can expose sensitive information from the system's kernel metadata.

Local access to the device is required.
Attacker triggers a GPU processing operation.
Sensitive kernel metadata is exposed.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows a non-privileged user to access sensitive kernel metadata through GPU processing operations. The impact is an information disclosure, where kernel metadata could be exposed. The exploitability is classified as internal, meaning it requires local access to the affected system.

Likely attacker skill level: Low.
Required access or conditions: Local, non-privileged user access.
Business risk or urgency: Low.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts organizations utilizing Arm's Mali GPU Kernel Driver. Successful exploitation could allow a local, non-privileged user to access sensitive kernel metadata, posing a risk to data confidentiality. The vulnerability has been documented and is considered to have low severity, but its presence on the Known Exploited Vulnerabilities catalog warrants attention.

Identify affected systems with the specified GPU drivers.
Isolate or restrict access to vulnerable systems.
Apply vendor updates, verify fixes, and monitor systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Arm Mali GPU Kernel Driver and what does it do?

The Arm Mali GPU Kernel Driver manages the graphics processing unit (GPU) in devices using Arm Mali graphics technology. It is essential for rendering graphics, displaying user interfaces, and processing visual data in applications like games.

How does CVE-2023-26083 create a vulnerability?

CVE-2023-26083 is a memory leak vulnerability (CWE-401). It allows a non-privileged user to execute valid GPU processing operations that expose sensitive kernel metadata, which is normally protected.

What are the conditions required to exploit CVE-2023-26083?

Exploitation requires local, non-privileged user access to the affected device. The attacker must trigger specific GPU processing operations to expose the sensitive kernel metadata.

What is the relevance of CVE-2023-26083 in threat advisories?

CVE-2023-26083 is listed on the Known Exploited Vulnerabilities (KEV) catalog. While classified as internal and low severity, its inclusion indicates potential risks, and organizations should apply vendor updates.

What steps should be taken to respond to this vulnerability?

Organizations should identify systems using vulnerable Arm Mali GPU Kernel Drivers. Restrict access to affected systems, apply updates provided by Arm, and monitor systems for any unusual activity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.