High severity · published May 24, 2021
CVE-2021-29256
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
In wildKEV
8.8
CVSS
3%
EPSS
Yes
On KEV
Description
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildYes
CISA KEVListed Jul 7, 2023
Federal remediation dueJul 28, 2023
Ransomware campaign useNot known
Affected products
Which versions
BG
Bifrost Gpu Kernel Driver · Arm
r16p0 before r30p0 · source: NVD
MG
Midgard Gpu Kernel Driver · Arm
r28p0 before r31p0 · source: NVD
VG
Valhall Gpu Kernel Driver · Arm
r19p0 before r30p0 · source: NVD
MG
Mali Graphics Processing Unit (GPU) · Arm
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29256
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29256
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver
More from Bifrost Gpu Kernel Driver
8.8
CVE-2022-38181
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
8.8
CVE-2021-28663
Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
8.8
CVE-2021-28664
Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
7.8
CVE-2024-4610
Mali GPU Kernel Driver allows improper GPU memory processing operations
7.8
CVE-2022-22706
Arm Mali GPU Kernel Driver Unspecified Vulnerability