CVE-2023-3889

Mali GPU Kernel Driver exposes sensitive data from freed memory

At a glance

Severity: HIGH 7.8
EPSS: EPSS 0.18 % · percentile 8 (2026-10-27)
State: PUBLISHED
Published: 2023-11-07
Updated: 2025-12-16
Assigner: Arm
NVD status: Modified

Description

A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Weaknesses (CWE)

European references

ENISA EUVD · EUVD-2023-44517
GCVE · GCVE-0-2023-3889

CERT-FR advisories

CERTFR-2023-AVI-0995 — Multiples vulnérabilités dans Google Android · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:* ≥ r38p0 ≤ r44p0

Affected products

Product	Versions
Arm Ltd · Valhall GPU Kernel Driver	affected r38p0 ≤ r44p0

References

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD