CVE-2023-28147

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r29p0 through r32p0, Bifrost r17p0 through r42p0 before r43p0, Valhall r19p0 through r42p0 before r43p0, and Arm's GPU Architecture Gen5 r41p0 through r42p0 before r43p0.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-281487.2A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.CVE-2023-281496.1An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 0CVE-2023-28159.8A vulnerability classified as critical was found in SourceCodester Online Jewelry Store 1.0. Affected by this vulnerability is an unknown fuCVE-2023-281509.8An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in CVE-2023-281519.8An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remoteCVE-2023-281529.8An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD inCVE-2023-281536.4An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restricCVE-2023-281549.8Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker whCVE-2023-281556.1The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protoCVE-2023-281585.4Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticaCVE-2023-281594.3The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion orCVE-2023-28166.5Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patc