CVE-2023-4211
MediumExploitedPublic exploitkernel: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Published Dec 5, 2023 · Updated Oct 14, 2026 · Also known as A-294605494, ASB-A-294605494, PUB-A-294605494
Key Facts
Patch immediately- CVE-2023-4211 is a medium-severity vulnerability (CVSS 5.5 v3.1) affecting 5th Gen Gpu Architecture Kernel Driver (Arm), Bifrost GPU Kernel Driver (Arm), Midgard GPU Kernel Driver (Arm) and 2 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 18, 2023. Public exploit code is available.
- EPSS estimates a 1.1% probability of exploitation in the next 30 days.
- Fixed versions are available, including :unknown: SoCVersion:2023-09-05, :unknown: SoCVersion:2023-10-05, 5th Gen Gpu Architecture Kernel Driver r43p0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
1.1%
Higher than 65.0% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2023-4211 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Oct 3, 2023 | Oct 24, 2023 | Not reported |
| Industry KEV feed | Sep 18, 2023 | Oct 24, 2023 | Not reported |
| CIRCL KEV | Oct 3, 2023 | Oct 24, 2023 | Not reported |
| ENISA EUVD | Oct 3, 2023 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Products
9 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| 5th Gen Gpu Architecture Kernel DriverArm | >= r41p0 | r43p0 |
| Bifrost GPU Kernel DriverArm | >= r0p0 | r43p0 |
| Midgard GPU Kernel DriverArm | >= r12p0 | r32p0 |
| Valhall GPU Kernel DriverArm | >= r19p0 | r43p0 |
| :unknown:android | >= SoCVersion:0 | SoCVersion:2023-10-05 |
Patched Releases
:unknown:
SoCVersion:2023-09-05, SoCVersion:2023-10-05
5th Gen Gpu Architecture Kernel Driver
r43p0
Bifrost GPU Kernel Driver
r43p0
Midgard GPU Kernel Driver
r32p0
Valhall GPU Kernel Driver
r43p0
Timeline
Added to Industry KEV feed
Sep 18, 2023
Added to CISA KEV
Oct 3, 2023
Added to CIRCL KEV
Oct 3, 2023
Added to ENISA EUVD
Oct 3, 2023
Publicly disclosed
Dec 5, 2023
Last updated
Oct 14, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisoryhttps://source.android.com/docs/security/bulletin/2023-12-01
- advisoryhttps://source.android.com/security/bulletin/2023-09-01
- advisoryhttps://source.android.com/security/bulletin/2023-10-01
- advisoryhttps://www.bleepingcomputer.com/news/security/android-october-security-update-fixes-zero-days-exploited-in-attacks/
- advisoryhttps://www.bleepingcomputer.com/news/security/december-android-updates-fix-critical-zero-click-rce-flaw/
FAQ
Common Questions.
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
Affected: 5th Gen Gpu Architecture Kernel Driver (Arm) versions >= r41p0; Bifrost GPU Kernel Driver (Arm) versions >= r0p0; Midgard GPU Kernel Driver (Arm) versions >= r12p0, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 18, 2023.
Yes. It was added on Oct 3, 2023 with a federal remediation due date of Oct 24, 2023.
Public exploit code is available.
Fixed versions are available, including :unknown: SoCVersion:2023-09-05, :unknown: SoCVersion:2023-10-05, 5th Gen Gpu Architecture Kernel Driver r43p0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2023-4211 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo