Junglewise Threat Intelligence

CVE-2021-28663: Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability

CVE-2021-28663 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2021-11-03

Technologies: Arm Valhall GPU Kernel Driver, Arm Mali Graphics Processing Unit (GPU), Arm Bifrost GPU Kernel Driver. Vendors: Arm.

Executive brief

The Arm Mali GPU kernel driver contains a use-after-free vulnerability due to the mishandling of GPU memory operations. This flaw allows a non-privileged user to perform improper operations on GPU memory, potentially leading to local privilege escalation to root or information disclosure.

Affected products

  • Arm Bifrost GPU Kernel Driver r0p0 through r28p0 before r29p0
  • Arm Valhall GPU Kernel Driver r19p0 through r28p0 before r29p0
  • Arm Midgard GPU Kernel Driver r4p0 through r30p0

Timeline

  • 2021-05-10: disclosed: NVD Published Date
  • 2021-11-03: kev added: Date added to CISA Known Exploited Vulnerabilities Catalog
  • 2021-11-03: other: Advisory publication date provided in report
  • 2021-11-03: exploited: Reported as exploited in the wild and listed in CISA KEV

Related threats