diff --git a/docs/advisories/20240611003-ARM-Mali-GPU-Vulnerability.md b/docs/advisories/20240611003-ARM-Mali-GPU-Vulnerability.md new file mode 100644 index 00000000..75757f46 --- /dev/null +++ b/docs/advisories/20240611003-ARM-Mali-GPU-Vulnerability.md @@ -0,0 +1,27 @@ +# ARM Mali GPU vulnerability active exploitation - 20240611003 + +## Overview + +ARM has notified of the active exploitation of a vulnerability which allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory. This vulnerability impacts all versions of Bifrost and Valhall drivers from r34p0 through r40p0. + +## What is vulnerable? + +| CVE | Severity | CVSS | Product(s) Affected | Dated | +| --------------------------------------------------------------- | -------------------------- | ---- | ------------------------------------------------ | ---------- | +| [CVE-2024-4610](https://nvd.nist.gov/vuln/detail/CVE-2024-4610) | **TBD at time of writing** | TBD | **Bifrost and Valhall from r34p0 through r40p0** | 07/06/2024 | + +## What has been observed? + +There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing. + +However, there is current known exploitation in the wild. + +## Recommendation + +The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)): + +- [Mali GPU Driver Vulnerabilities](https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities) + +## Additional References + +- [Arm warns of actively exploited flaw in Mali GPU kernel drivers](https://www.bleepingcomputer.com/news/security/arm-warns-of-actively-exploited-flaw-in-mali-gpu-kernel-drivers/)