Arm · Mali Graphics Processing Unit (GPU)
CVE-2021-29256
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
What it is
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
CISA: Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
What to do
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Deadline for US federal agencies: July 28, 2023
More exploited flaws from Arm
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 7, 2023 | Mali GPU Kernel Driver Information Disclosure | Mali Graphics Processing Unit (GPU) | Low 3.3 | 1.2% |
| Mar 30, 2023 | Mali GPU Kernel Driver Unspecified | Mali Graphics Processing Unit (GPU) | High 7.8 | 1.1% |
| Mar 30, 2023 | Mali GPU Kernel Driver Use-After-Free | Mali Graphics Processing Unit (GPU) | High 8.8 | 18% |
| Nov 3, 2021 | Use-After-Free | Mali Graphics Processing Unit (GPU) | High 8.8 | 12% |
| Nov 3, 2021 | Unspecified | Mali Graphics Processing Unit (GPU) | High 8.8 | 5.4% |
| Jun 12, 2024 | Use-After-Free | Mali GPU Kernel Driver | High 7.4 | 0.8% |
| Oct 3, 2023 | Use-After-Free | Mali GPU Kernel Driver | Medium 5.5 | 1.1% |
| Nov 3, 2021 | Out-of-Bounds Write | Trusted Firmware | Medium 5.5 | 3.1% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.