Loading vulnerability…
CVE-2023-6241 is a use-after-free vulnerability in Arm Mali GPU kernel drivers affecting Midgard, Bifrost, Valhall, and Arm 5th Gen GPU Architecture driver branches. The flaw is rooted in a race condition in the JIT memory growth path, specifically in the kbase_jit_grow function. During growth of a GPU memory region, the driver caches the current allocation size before dropping locks to refill the memory pool. If a concurrent page fault grows the same region during that race window, the driver later resumes using stale size information while other code paths use the updated allocation state. This inconsistency can cause physical pages to be allocated and tracked differently from how GPU mappings are established, leaving some pages backed but unmapped. Subsequent shrinking and teardown operations can then free physical pages while stale mappings remain accessible, producing a page-level use-after-free condition. A local unprivileged attacker who can carefully shape memory state and trigger the race can exploit the bug to obtain powerful kernel memory manipulation primitives.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository contains a full operational exploit for CVE-2023-6241, targeting the Mali GPU driver on Google Pixel 7 devices running specific vulnerable kernel versions. The exploit is implemented in C and ARM64 assembly, with supporting OpenCL headers and Mali kernel interface headers. The main exploit logic resides in 'mali_jit_csf.c', which interacts directly with the '/dev/mali0' device node to manipulate GPU memory management and trigger a vulnerability in the Mali driver. The exploit achieves kernel code execution by corrupting memory structures, disables SELinux enforcement by overwriting the enforcement variable, and escalates privileges to root by calling kernel functions (init_cred, commit_creds) via crafted shellcode. Upon success, it spawns a root shell. The repository also includes detailed instructions in the README for extracting kernel symbols, preparing the device, and compiling/executing the exploit. The code is tailored for the Pixel 7 but is based on prior work for the Pixel 8, with offsets and payloads adapted for the target device. The attack vector is local, requiring code execution on the device (e.g., via adb shell or a malicious app with sufficient privileges). The exploit is not part of a framework and is a standalone operational exploit with a hardcoded payload.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.