Mind the Gap

Summary: Project Zero researcher Jann Horn found five exploitable vulnerabilities in the ARM Mali GPU driver between June and July 2022, after a FirstCon22 talk noted that roughly 50% of observed 0-days in the first half of 2022 were variants of previously patched bugs. ARM fixed the issues promptly in July and August 2022 and assigned CVE-2022-36449, but Project Zero's test devices using Mali remained vulnerable and the CVE is not mentioned in any downstream security bulletins.
What you should know: The fix exists upstream, yet every Mali-based device Project Zero tested - across Pixel, Samsung, Xiaomi and Oppo - still carried the flaw, and multiple sources said the Mali issues collided with vulnerabilities available in the 0-day market.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-39793 CVE-2022-22706 CVE-2022-33917 CVE-2022-36449
Related: CVE-2022-22706: Arm Mali GPU Kernel Driver Unspecified Vulnerability Known Exploited Vulnerabilities · Mar 30, 2023
CVE-2021-39793: Google Pixel Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Apr 11, 2022
Analyzing a Modern In-the-wild Android Exploit Cyber Risks ·