CVE-2021-39793highunder attackCWE-787

CVE-2021-39793: high-severity vulnerability in Android

Published · Updated

Follow this CVE+ Monitor Android+ Monitor Pixel Watch

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 0.7%
from disclosure to weapon
Published on NVDMar 16
CISA KEV+26d
Action required by CISAfederal deadline: 2022-05-02

Apply updates per vendor instructions.

In short

A logic error in Android's Mali GPU driver allows writing data beyond allocated memory boundaries, enabling attackers to escalate privileges locally without needing special permissions or user interaction.

Technical detail

CVE-2021-39793 is an out-of-bounds write vulnerability (CWE-787) in the kbase_jd_user_buf_pin_pages function of mali_kbase_mem.c. The vulnerability stems from a logic error that permits writing beyond buffer boundaries, allowing local privilege escalation; exploitation requires no additional execution privileges or user interaction.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Android