Arm Mali Race Condition
Posted by deepcore on September 21, 2022 – 4:16 am
The Mali driver frees GPU page tables before removing the higher-level PTEs pointing to those page tables (and, therefore, also before issuing the required flushes). This means a racing memory write instruction on the GPU can write to an attacker-controlled physical address.
Post a reply
You must be logged in to post a comment.