CVE-2022-38181

· HIGHAnalyzed

← All CVEs

CVSS v3.1

8.8

EPSS

12.82%

Published

Oct 25, 2022

Modified

Nov 3, 2025

CISA Known Exploited Vulnerability

Added: 2023-03-30 · Due: 2023-04-20

Apply updates per vendor instructions.

Public PoC / Exploit (5)

All weaponized →

TrickestTrickest PoC index GitHub PoCPro-me3us/CVE_2022_38181_Raven★7 GitHub PoCPro-me3us/CVE_2022_38181_Gazelle★3 GitHub PoCR0rt1z2/CVE-2022-38181★3 GitHub PoCsoralis0912/CVE-2022-38181-aristotle★0

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-416CWE-416

Affected Products (5)

arm · bifrost_gpu_kernel_drivervulnerable

arm · midgard_gpu_kernel_drivervulnerable

arm · valhall_gpu_kernel_drivervulnerable

References (11)

http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html

Third Party AdvisoryVDB Entry

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

Vendor Advisory

https://developer.arm.com/support/arm-security-updates

Vendor Advisory

https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/

ExploitThird Party Advisory

https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/

ExploitThird Party Advisory

http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html

Third Party AdvisoryVDB Entry

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

Vendor Advisory

https://developer.arm.com/support/arm-security-updates

Vendor Advisory

https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/

ExploitThird Party Advisory

https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/

ExploitThird Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38181

US Government Resource

KEV Catalog EPSS Scores Vendors All CVEs