CVE-2022-38181

What it actually does

CVE-2022-38181 is a use-after-free vulnerability in the Arm Mali GPU kernel driver affecting Bifrost, Valhall, and Midgard driver branches. The driver mishandles GPU memory operations, allowing an unprivileged user-space process to reference memory after it has been freed. Because the vulnerable code runs in kernel context, successful exploitation can disclose kernel memory, corrupt kernel memory, escalate privileges, or crash the device. In practical terms, this can let a low-privileged local process escape application sandboxing and gain elevated control over an Android or Linux-based system using an affected Mali GPU driver.

Why it matters to the business

Systems using affected Arm Mali GPU drivers can be compromised by malware or an attacker who has obtained low-privileged code execution, such as through a malicious application, browser exploit chain, or compromised user process. The vulnerability is listed in CISA KEV with active exploitation in the wild and had a federal remediation deadline of 2023-04-20, so unpatched devices should be treated as high-priority exposure. Business consequences include device takeover, data theft, persistence of mobile or embedded malware, service disruption from kernel crashes, and increased risk to fleets of Android, IoT, embedded Linux, and other products built on Mali GPU platforms.

How an attack unfolds

An attacker first obtains the ability to run code as an unprivileged user on a device with an affected Mali GPU kernel driver. This may occur through a malicious application, a compromised browser or renderer process, a chained remote-code-execution bug, or direct local access. The attacker then opens the Mali GPU device interface, commonly exposed through a device node such as /dev/mali0, and performs crafted GPU memory operations through driver ioctls. By manipulating allocation and release timing, the attacker causes the driver to operate on freed memory. The freed memory can then be reused or shaped so that subsequent kernel access leaks sensitive data, corrupts kernel structures, or redirects execution flow. Successful exploitation can elevate the attacker from an unprivileged process to kernel-level capabilities, enabling sandbox escape, disabling protections, installing privileged malware, dumping sensitive data, or maintaining persistence. Because this vulnerability has been exploited in the wild, defenders should assume exploit chains may combine it with an initial browser, messaging, or application vulnerability rather than relying on direct interactive access.

How to fix it

Update affected devices to a vendor firmware, kernel, Android security update, BSP, or GPU driver release that contains Arm’s fix for the Mali GPU kernel driver use-after-free issue. The affected ranges are Bifrost r0p0 through r38p1 and r39p0, Valhall r19p0 through r38p1 and r39p0, and Midgard r4p0 through r32p0; deployments should move to a vendor-confirmed non-affected driver branch or patched backport. Because fixed versions vary by OEM, SoC vendor, Linux distribution, Android device vendor, and embedded product firmware, rely on the device or platform vendor’s security advisory rather than upstream branch naming alone. Where immediate patching is not possible, reduce risk by restricting installation of untrusted applications, hardening application sandboxing, disabling unnecessary GPU access for untrusted workloads where feasible, limiting local shell access, enforcing mobile device management controls, and prioritizing replacement or isolation of devices that no longer receive vendor security updates.

How to confirm the fix worked

Confirm remediation by inventorying devices for Mali GPU usage and checking the installed GPU kernel driver or firmware package against the vendor advisory. On Linux-based systems, review kernel module metadata, device firmware release notes, distribution package versions, and kernel build information for a patched Mali kbase driver. On Android-based systems, verify that the device has received the relevant OEM security update containing the Mali GPU driver fix and that the patch level or build fingerprint corresponds to a vendor-confirmed fixed release. Validate that affected branches are no longer present: Bifrost r0p0-r38p1/r39p0, Valhall r19p0-r38p1/r39p0, and Midgard r4p0-r32p0. If feasible, run vendor-provided validation tests or vulnerability assessment tooling that checks the GPU driver version. Also confirm that untrusted workloads do not have unnecessary access to Mali device nodes and that no unsupported devices remain exposed without compensating controls.

Typical attack path

1. Identify a target device or product using an affected Arm Mali Bifrost, Valhall, or Midgard GPU kernel driver branch.
2. Gain low-privileged code execution on the target, for example through a malicious app, compromised user process, or chained remote exploit.
3. Open the Mali GPU kernel driver device interface, such as /dev/mali0, from the unprivileged process.
4. Issue crafted GPU memory allocation, mapping, freeing, and synchronization operations to trigger the use-after-free condition.
5. Shape or reclaim the freed memory so the kernel driver reads from or writes to attacker-influenced memory.
6. Use the resulting memory disclosure or corruption primitive to escalate privileges or escape an application sandbox.
7. Execute follow-on actions with elevated privileges, such as accessing protected data, tampering with security controls, installing malware, or causing device instability.

How to detect it

Detection is difficult because successful exploitation occurs inside a kernel driver and may not leave a single reliable indicator. Use a combination of endpoint, mobile, kernel, and application telemetry. Review kernel logs such as dmesg, journalctl, Android logcat, pstore/ramoops, crash dumps, and OEM diagnostic logs for Mali GPU driver faults, use-after-free-like crashes, GPU memory faults, kernel oops/panic events, and suspicious crashes in processes that interact with the GPU device node. Look for untrusted or unexpected processes opening /dev/mali0 or other Mali device interfaces, especially followed by privilege changes, SELinux/AppArmor denials, kernel crashes, or execution of privileged commands. On Android, review app install history, Play Protect/MDM telemetry, logcat, tombstones, crash reports, and signs of sandbox escape such as an ordinary app spawning privileged processes, modifying protected locations, or disabling security controls. On Linux/embedded systems, correlate auditd/eBPF/EDR telemetry showing access to Mali device nodes with subsequent UID changes, new setuid files, kernel module tampering, persistence creation, or anomalous network connections. Because active exploitation has been reported broadly for this vulnerability class, also hunt for exploit-chain evidence preceding driver interaction, such as browser, renderer, messaging, or document-processing crashes followed by local privilege escalation artifacts.

• /dev/mali0
• /dev/midgard0
• mali_kbase
• mali_kbase.ko
• mali.ko
• kbase_jd
• kbase_mem
• kbase_ioctl
• GPU fault
• Mali GPU fault
• mali_kbase:
• Unable to handle kernel paging request
• BUG: kernel NULL pointer dereference
• kernel panic - not syncing
• Oops:
• ramoops
• pstore
• /sys/module/mali_kbase
• /sys/class/misc/mali0
• /proc/modules

What your security team should do

• Prioritize patching or firmware updates for all devices using affected Arm Mali GPU drivers because the vulnerability is in CISA KEV and has active in-the-wild exploitation history.
• Build or update asset inventory to identify Android, embedded Linux, IoT, Chromebook-like, and appliance platforms that include Arm Mali Bifrost, Valhall, or Midgard GPUs.
• Obtain fixed firmware, kernel, BSP, Android security updates, or GPU driver packages from the OEM, SoC vendor, Linux distribution, or device manufacturer, and verify that the fix is actually included.
• Treat unsupported products that cannot receive a patched Mali driver as high risk; isolate, restrict app installation, limit local/user access, or plan replacement.
• Hunt for signs of prior local privilege escalation involving the Mali driver, including suspicious access to /dev/mali0, kernel faults in mali_kbase code, app crashes followed by privilege changes, and unexpected root-level processes.
• Review mobile and endpoint telemetry for exploit-chain behavior, especially suspicious app installation, browser or renderer compromise followed by kernel-driver interaction, and post-exploitation activity.
• Apply defense-in-depth controls such as application allowlisting, verified boot, SELinux/AppArmor enforcement, least-privilege device-node permissions, and removal of unnecessary debug or shell access.
• Monitor vendor advisories and CISA KEV updates for related Mali GPU vulnerabilities, since attackers commonly chain mobile and GPU driver flaws.