Loading vulnerability…
A use-after-free vulnerability in the Arm Mali GPU Kernel Driver allows a local non-privileged user to trigger improper GPU memory processing operations and gain access to memory that has already been freed. The issue affects multiple Mali GPU kernel driver lines, including Midgard r0p0 through r32p0, Bifrost r0p0 through r41p0 before r42p0, Valhall r19p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0. The flaw arises from improper handling of GPU processing operations that permits stale memory references after deallocation, creating an opportunity for unauthorized access to freed kernel-associated memory.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a local QEMU/no-Mali reproduction lab for CVE-2022-46395 in the Arm Mali r36p0 driver lineage, not just a standalone exploit drop. Its structure is split into: (1) `poc/`, containing the adapted userland exploit code and helper headers; (2) `src/google-gpu-raviole-android13/`, a large vendored copy of the Google Pixel Mali driver source used to build a vulnerable `mali_kbase.ko`; (3) `scripts/`, which automate building the module and PoC, packaging an initramfs, and booting QEMU; (4) `docs/` and `logs/`, which document and evidence successful reproduction. The main exploit logic is in `poc/mali_user_buf.c`. It opens `/dev/mali0`, allocates and frees GPU memory via Mali ioctls, submits crafted GPU jobs, and repeatedly races the soft-event/user-buffer path until the vulnerable timing condition is reached. In `LAB_QEMU` mode, the code intentionally skips Android fingerprint checks and Pixel-specific kernel text patching, then exits successfully once the race is reproduced. Outside lab mode, the same code contains the original exploit chain logic for specific Pixel 6 Android 13 builds: it selects hard-coded offsets based on build fingerprint, prepares ARM64 shellcode via `fixup_root_shell()`, and uses GPU write-value jobs (`mem_write.c`) to overwrite kernel code/data, disable SELinux, and call `commit_creds(init_cred)`. The repository therefore contains both a real exploit lineage and a safer lab adaptation. The QEMU version is operational as a local kernel race reproducer and optional KASAN evidence generator, but it deliberately omits the final real-device privilege-escalation stage. The included driver source and scripts are essential to the lab: `build_r36p0_no_mali.sh` compiles the no-Mali kernel module, `build_poc.sh` builds a static PoC binary with `-DLAB_QEMU`, `package_initramfs.sh` creates a bootable initramfs that loads the module and runs the PoC, and `run_qemu.sh` boots the guest with `nokaslr` and serial console logging. No external C2 or remote network infrastructure is present. The attack vector is local against a vulnerable kernel driver device node. The most fingerprintable artifacts are local file/device paths, the module parameter `cve_46395_kasan_uaf_probe`, and the targeted driver version `r36p0-01eac0`. Overall, this is a legitimate exploit/reproduction repository with a dual purpose: preserve the original exploit mechanics while packaging a controlled QEMU lab that demonstrates the vulnerable race without shipping the full Pixel root payload.
This repository contains a working exploit for CVE-2022-46395, targeting the ARM Mali GPU kernel driver on the Amazon FireTV 3rd gen Cube (FireOS, 32-bit user space). The exploit leverages a vulnerability in the Mali kernel driver to achieve arbitrary kernel code execution. The main payload disables SELinux and escalates privileges to root by invoking kernel functions (prepare_kernel_cred and commit_creds) via custom ARM shellcode. The exploit is implemented in C, with the main entry point in 'mali_user_buf.c'. Supporting files include headers for the Mali driver interface, memory pool utilities, and job submission structures. The exploit interacts directly with the device file '/dev/mali0' and manipulates kernel memory mappings to inject and execute the payload. The README provides compilation and usage instructions, and the exploit is operational, providing a root shell if successful. The code is not part of a framework and is a standalone proof-of-concept with a functional payload.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.