CVE-2022-36449

Severity CVSS v4.0:

Pending analysis

Type:

CWE-416 Use After Free

Publication date:

01/09/2022

Last modified:

07/04/2025

Description

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 6.50 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): Low
Integrity (I): Low
Availability (A): None

Base Score 3.x

6.50

Severity 3.x

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:arm:bifrost_gpu_kernel_driver::::::::	r0p0 (including)	r38p0 (including)
cpe:2.3:a:arm:bifrost_gpu_kernel_driver:r39p0:::::::*
cpe:2.3:a:arm:midgard_gpu_kernel_driver::::::::	r4p0 (including)	r32p0 (including)
cpe:2.3:a:arm:valhall_gpu_kernel_driver::::::::	r19p0 (including)	r38p0 (including)
cpe:2.3:a:arm:valhall_gpu_kernel_driver:r39p0:::::::*

To consult the complete list of CPE names with products and versions, see this page

CVE-2022-36449

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools