Threat database

CVE-2023-3889 is a high-severity vulnerability in the Arm Ltd Valhall GPU Kernel Driver (version r38p0) that allows a local non-privileged user to perform improper GPU memory operations. This flaw involves improper restriction of operations within memory buffer bounds, potentially enabling access to freed memory areas. Exploitation could lead to full compromise of confidentiality, integrity, and availability of the affected system without requiring user interaction. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk due to its high CVSS score of 7.8. European organizations using devices with Arm Valhall GPUs, especially in embedded or mobile environments, should prioritize patching and monitoring. Mitigation includes applying vendor patches once available, restricting local user access, and employing memory protection mechanisms. Countries with strong mobile and embedded device markets, such as Germany, France, and the UK, are more likely to be impacted. The vulnerability’s ease of exploitation by local users and its broad impact on system security classify it as a high-severity threat.

EPSS 0.2%VulnerabilityArm Ltd#cwe-119#cwe-667Germany+7

A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

KEVEPSS 1.1%VulnerabilityArm Ltd#cwe-416Germany+6