high8.8Known exploited
CVE-2021-28663
Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2021-11-17.
Apply updates per vendor instructions.
Impact
The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Arm | Bifrost Gpu Kernel Driver | from r0p0 before r29p0 |
| Arm | Midgard Gpu Kernel Driver | from r4p0 before r31p0 |
| Arm | Valhall Gpu Kernel Driver | from r19p0 before r29p0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://developer.arm.com/support/arm-security-updates
- https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver
- https://github.com/lntrx/CVE-2021-28663
- https://developer.arm.com/support/arm-security-updates
- https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver
- https://github.com/lntrx/CVE-2021-28663
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28663