CVE-2021-28664highunder attackCWE-787

CVE-2021-28664

Published · Updated

Follow this CVE+ Monitor Mali Graphics Processing Unit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 5.4%
from disclosure to weapon
Published on NVDMay 10
CISA KEV+177d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A flaw in the Arm Mali GPU driver lets unprivileged users gain unauthorized read and write access to memory pages that should be read-only, potentially allowing them to take control of the system or crash it.

Technical detail

The Mali GPU kernel driver (Bifrost, Valhall, Midgard) contains an out-of-bounds write vulnerability (CWE-787) allowing unprivileged users to modify read-only memory pages. This enables privilege escalation or denial of service through memory corruption. Affected versions: Bifrost r0p0–r29p0, Valhall r19p0–r29p0, Midgard r8p0–r30p0.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0 through r30p0 before r31p0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a