{"id":"CVE-2022-38181","published":"2022-10-25T19:15:11Z","modified":"2026-06-17T04:56:14Z","title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability","vendor":"Arm","product":"Mali Graphics Processing Unit (GPU)","tier":"core","eol":null,"description":{"text":"The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.","provenance":"source","from":"NVD"},"summary":{"text":"The Arm Mali GPU kernel driver contains a use-after-free flaw in how it handles GPU memory operations, allowing access to memory that has already been freed. An attacker with a low-privilege local account (unprivileged user on the affected device) can exploit it without user interaction to read or modify freed memory, with the affected range spanning Bifrost r0p0 through r38p1 and r39p0, Valhall r19p0 through r38p1 and r39p0, and Midgard r4p0 through r32p0.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:38Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.18461,"percentile":0.97233,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-03-30","dueDate":"2023-04-20","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities;  https://nvd.nist.gov/vuln/detail/CVE-2022-38181","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-03-29","exploitedFirstSeen":"2023-03-29","ransomware":false,"evidence":[{"url":"https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/","date":"2023-03-29"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-03-30"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities","tags":["Vendor Advisory"]},{"url":"https://developer.arm.com/support/arm-security-updates","tags":["Vendor Advisory"]},{"url":"https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/","tags":["Exploit","Third Party Advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities","tags":["Vendor Advisory"]},{"url":"https://developer.arm.com/support/arm-security-updates","tags":["Vendor Advisory"]},{"url":"https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/","tags":["Exploit","Third Party Advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38181","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Local unprivileged user exploits kernel driver flaw","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"The Arm Mali GPU kernel driver allows unprivileged users to access freed memory","start":0,"end":79}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Reads freed kernel memory contents","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows unprivileged users to access freed memory","start":31,"end":79}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-40775","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-40775","exploited":true,"exploitedSince":"2023-03-30","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2023-04-13","earliestUrl":"https://github.com/Pro-me3us/CVE_2022_38181_Raven","repos":[{"name":"Pro-me3us/CVE_2022_38181_Raven","url":"https://github.com/Pro-me3us/CVE_2022_38181_Raven","stars":11,"created":"2023-04-13"},{"name":"ericpardee/fire-hd-ownership","url":"https://github.com/ericpardee/fire-hd-ownership","stars":6,"created":"2026-08-20"},{"name":"Pro-me3us/CVE_2022_38181_Gazelle","url":"https://github.com/Pro-me3us/CVE_2022_38181_Gazelle","stars":5,"created":"2023-04-13"},{"name":"R0rt1z2/CVE-2022-38181","url":"https://github.com/R0rt1z2/CVE-2022-38181","stars":3,"created":"2023-05-12"},{"name":"s1204IT/CVE-2022-38181","url":"https://github.com/s1204IT/CVE-2022-38181","stars":3,"created":"2026-10-29"}]},"first":{"date":"2023-04-13","source":"PoC-in-GitHub","url":"https://github.com/Pro-me3us/CVE_2022_38181_Raven"},"provenance":"source"},"exploitRefs":["https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/","https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/","http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2022-10-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38181","provenance":"source"},{"date":"2023-03-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/","provenance":"source"},{"date":"2023-03-30","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-03-30","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-40775","provenance":"source"},{"date":"2023-04-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Pro-me3us/CVE_2022_38181_Raven","provenance":"source"}],"speed":{"daysToPublicExploit":170,"firstExploitFrom":"PoC-in-GitHub","daysToKev":156},"priority":{"score":68.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1311 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.45,"detail":"percentile 0.9723"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 NVD exploit link; 6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}