CVE-2023-22808

Published: Apr 11, 2023Modified: Jun 17, 2026

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: NVD

Description

An issue was discovered in the Arm Android Gralloc Module. A non-privileged user can read a small portion of the allocator process memory. This affects Bifrost r24p0 through r41p0 before r42p0, Valhall r24p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0.

Affected (3)

Products: Arm: Avalon Android Gralloc Module, Bifrost Android Gralloc Module, Valhall Android Gralloc Module

Arm

3 products

Avalon Android Gralloc Module

Bifrost Android Gralloc Module

Valhall Android Gralloc Module

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Arm Avalon Android Gralloc Module	Version r41p0
Arm Bifrost Android Gralloc Module	From r24p0 to r41p0
Arm Valhall Android Gralloc Module	From r24p0 to r41p0

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (2)

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

Source: cve@mitre.org

Vendor Advisory

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.