CVE-2022-28348
En bref
- Source
- NVD
- EPSS
- EPSS 1.45 % · centile 73 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper GPU memory operations to reach a use-after-free situation.
Faiblesses (CWE)
- CWE-416 — Utilisation après libération
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2022-32798
- GCVE · GCVE-0-2022-28348
Avis du CERT-FR
- CERTFR-2023-AVI-0811 — Multiples vulnérabilités dans Google Android · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*≥ r0p0 ≤ r36p0cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*≥ r4p0 ≤ r31p0cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*≥ r19p0 ≤ r36p0
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |