CVE-2021-28664KEV · OVERDUE

Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability

High · published May 10, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 92.7th percentile for exploit probability.

1801
days past CISA
deadline
CVSS v3.1
8.8
EPSS
5%
Percentile
92.7
In the wild
Confirmed
What it is

🚨 An unprivileged user can read and write to protected memory pages, triggering potential privilege escalation or service disruption! 🔥 Think of it like a sneaky diner who magically finds a way into the kitchen, tampering with recipes meant to be off-limits — they could not only poison the dish but also serve themselves a gourmet meal! An attacker exploiting this vulnerability can escalate privileges or cause a denial of service, leading to system crashes or unauthorized access — absolutely devastating for your applications! Imagine the chaos if anyone could mess with the critical components of your system, rendering it unstable or compromised!

Put simply

Think of it like a sneaky diner who magically finds a way into the kitchen, tampering with recipes meant to be off-limits — they could not only poison the dish but also serve themselves a gourmet meal! This vulnerability in the Arm Mali GPU kernel driver allows an unprivileged user to gain read/write access to read-only memory pages, specifically affecting Bifrost, Valhall, and Midgard GPUs. This means that an attacker can manipulate memory in ways that could lead to privilege escalation or system downtime.

What to do

An attacker exploiting this vulnerability can escalate privileges or cause a denial of service, leading to system crashes or unauthorized access — absolutely devastating for your applications! Imagine the chaos if anyone could mess with the critical components of your system, rendering it unstable or compromised! To safeguard your systems, patch the affected drivers to version r30p0 or later. Ensure that your team audits user privileges and implements robust monitoring to detect any unusual access patterns. Don't let this vulnerability sneak into your environment! You've got this! Implement these steps and you'll have your systems secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.05407 · 92.7th percentile
Published
2021-05-10T00:00Z
KEV added
2021-11-03 · due 2021-11-17
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 10 MAY 00:00Z
    The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write…
    cvelistv5