Loading vulnerability…
A use-after-free vulnerability in the Arm Mali GPU Kernel Driver affects Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0. The flaw arises because improper GPU memory operations can cause the driver to access memory after it has been freed, creating a stale reference condition in kernel-space GPU memory handling. An unprivileged local user can trigger the vulnerable state through crafted GPU memory operations, leading to unsafe reuse of freed objects within the driver.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a local proof-of-concept and lab environment for reproducing CVE-2022-20186 / Arm CVE-2022-28348, an integer overflow in Arm Mali GPU Kernel Driver alias handling that leads to a use-after-free. It is not a remote exploit or framework module; it is a reproducible research setup that builds a vulnerable Linux kernel environment, compiles the Mali driver as a module, packages a PoC into an initramfs, and launches a QEMU VM for testing. Repository structure is centered around build-env/. The local/ scripts automate dependency checks, kernel download (Linux 5.10.30), kernel compilation, rootfs creation, PoC compilation, and out-of-tree Mali module compilation. The arm/ directory provides a Dockerized ARM64 build path for Apple Silicon and includes scripts to build the kernel/rootfs and run QEMU. The dist/ directory contains launchers for x86_64 and ARM64 QEMU guests. The mali-driver/ tree is a large vendor driver source snapshot containing the vulnerable driver and supporting modules. Documentation files (README.md, QUICKSTART.md, INSTALL_GUIDE.md) explain how to build, boot, insmod the module, and run /poc/poc. Exploit capability is limited to vulnerability triggering/reproduction. The docs explicitly describe loading mali_kbase.ko and running /poc/poc, with expected output indicating /dev/mali0 access, region allocation, alias creation, and a resulting UAF condition. No post-exploitation payload, persistence, credential theft, reverse shell, or automated privilege-escalation chain is present in the provided content. Accordingly, this is best classified as a POC exploit rather than an operational or weaponized exploit. Notable observables include kernel and driver download URLs, guest file paths such as /poc/poc and /poc/mali_kbase.ko, the Mali device node /dev/mali0, multiple sysfs Mali interfaces documented under /sys/class/misc/mali%u/device/, and QEMU launchers exposing the default GDB stub via -s (TCP 1234).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.