Loading vulnerability…
Integer overflow out-of-bounds write in Pixel Mali GPU driver
CVE-2023-48409 is a local privilege-escalation vulnerability in the Google Pixel Mali GPU kernel driver. The flaw is in gpu_pixel_handle_buffer_liveness_update_ioctl in private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, where attacker-controlled size calculations used for allocation can overflow. The vulnerable path allocates memory using an expression of the form kmalloc(buffer_info_size * 2 + live_ranges_size, GFP_KERNEL); if the supplied counts are large enough, the arithmetic can wrap, resulting in an undersized allocation followed by writes beyond the end of the allocated buffer. The resulting memory corruption is an out-of-bounds write in kernel context. Supporting analysis indicates the primitive can be shaped into an arbitrary-size kmalloc combined with an arbitrary-length, 0x10-byte-aligned buffer underflow/out-of-bounds write from the allocated object. On affected Pixel devices, this bug is reachable via the Mali GPU driver ioctl interface from an unprivileged local context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt kernel memory and achieve local escalation of privilege. The provided context states exploitation requires no additional execution privileges and no user interaction. Public exploit-development analysis further indicates the bug can be leveraged to obtain arbitrary kernel or physical memory read/write by corrupting page-allocator-backed objects and page tables, which can then be used to modify credential-related kernel state, bypass capability checks, and disable SELinux enforcement on vulnerable devices. In practical terms, exploitation can result in full device compromise from an unprivileged local process.
If you can’t patch tonight, do this now.
Until patches are applied, reduce exposure by restricting access to the vulnerable Mali GPU device interface to trusted code only where operationally feasible. Minimize availability of untrusted local code execution on affected devices, including sideloaded or developer-enabled workloads that can reach the GPU ioctl surface. Enterprise controls that prevent arbitrary app installation and enforce rapid OTA uptake can reduce risk, but there is no complete mitigation equivalent to vendor patching for exposed vulnerable kernels.
Patch, then assume compromise.
Apply the December 2023 Pixel security update or later. The provided context states CVE-2023-48409 was fixed in the December 2023 Pixel Security Bulletin. Systems running pre-December 2023 vulnerable Pixel builds should be updated to a patched kernel/firmware image containing the corrected Mali GPU driver code and safe bounds/overflow handling in the affected ioctl path.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.