Executive Summary
Qualcomm and Arm have released security updates to patch several zero-day vulnerabilities exploited in recent targeted attacks against their chips.
These vulnerabilities pose a significant security risk and require immediate attention. Here is a brief summary of the vulnerabilities:
Qualcomm Vulnerabilities:
Qualcomm disclosed four zero-day vulnerabilities in its chips that are used in billions of smartphones and other devices around the world.
CVE-2023-33106, CVE-2023-33107, CVE-2022-22071, and CVE-2023-33063 are zero-day vulnerabilities being exploited.
Although details of the zero-day flaws won’t be shared by the chip giant until its December bulletin, updates have been issued for Adreno GPU and Compute DSP drivers.
The vulnerabilities, which have been exploited in limited, targeted attacks, could allow attackers to take control of affected devices or steal sensitive data.
Impacted OEMs have been notified and urged to deploy the security updates promptly.
Arm Vulnerability:
CVE-2023-4211 is an actively exploited vulnerability in Mali GPU drivers.
Arm’s impacted Mali GPUs are used on a variety devices, most prominently on Android phones by Google, Samsung, Huawei, Nokia, Xiaomi, Oppo, and other manufacturers.
Arm has addressed the vulnerability for Bifrost, Valhall, and Arm 5th Gen GPU architecture with kernel driver version r43p0.
It is crucial for affected users to apply the updates as soon as they become available through their device manufacturers. Additionally, users are advised to limit app downloads to trusted repositories to minimize the risk of malware infections.
Please see more information about the vulnerabilities below.
Qualcomm Vulnerabilities
These vulnerabilities were discovered as part of Google Project Zero and were disclosed to Qualcomm by Google Threat Analysis Group. Qualcomm then patched them.
CVE-2023-33106:
The details of the vulnerability have not been released by Qualcomm, but it is known to be a privilege escalation vulnerability in the Adreno GPU driver.
This vulnerability could allow a local attacker to gain elevated privileges on the system by using a use-after-free in the Adreno GPU driver.
CVE-2023-33107
The details of the vulnerability have not been released by Qualcomm, but it is known to be a privilege escalation vulnerability in the Compute DSP driver.
This vulnerability could allow a local attacker to gain elevated privileges on the system by using a use-after-free in the Compute DSP driver.
CVE-2022-22071
CVE-2022-22071 is a vulnerability that was patched by Qualcomm in May 2022. It is a use-after-free vulnerability in the Automotive OS Platform.
The vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by freeing process shell memory using IOCTL munmap call while process initialization is in progress. The vulnerability has a CVSS of 8.4.
CVE-2023-33063
It is a buffer copy vulnerability in the WLAN firmware. The vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by copying a buffer without checking its size. The vulnerability has a CVSS of 8.8.
Qualcomm has announced the following in their security advisory:
There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 may be under limited, targeted exploitation. Patches for the issues affecting Adreno GPU and Compute DSP drivers have been made available, and OEMs have been notified with a strong recommendation to deploy security updates as soon as possible. Please contact your device manufacturer for more information on the patch status about specific devices. CVE-2022-22071 was included in our May 2022 public bulletin. The details of the remaining CVEs will be shared in our December 2023 public bulletin.
You can find more information in the Qualcomm security advisory.
Arm Vulnerabilities
It was discovered on October 1st, 2023. It allows a local non-privileged user to gain access to already freed memory by making improper GPU memory processing operations. It has a CVSS of 5.5. There are indications that it may be under limited, targeted exploitation.
Red Hat has also acknowledged this vulnerability.
The vulnerability was addressed as part of the 2023-10-05 security patch level.
Please see below other vulnerabilities addressed in the patch.
It affects Arm Mali GPU drivers and allows a local non-privileged user to exploit a software race condition by making improper GPU processing operations, which can lead to accessing already freed memory. It has a CVSS of 4.7.
Arm has addressed it for the Bifrost, Valhall, and Arm 5th Gen GPU architecture with kernel driver version r43p0, which was released on March 24, 2023.
It was discovered on October 3rd, 2023. It affects Arm Mali GPU drivers and allows a local non-privileged user to make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a race condition to perform improper GPU operations to access already freed memory. It has a CVSS of 4.7.
Arm has addressed it for the Valhall GPU Kernel Driver r44p0 and Arm 5th Gen GPU Architecture Kernel Driver r44p0.
You can find more information in the Arm security advisory.
