CVE-2021-29256KEV · OVERDUE

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

High · published May 24, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 87.2th percentile for exploit probability.

1184
days past CISA
deadline
CVSS v3.1
8.8
EPSS
3%
Percentile
87.2
In the wild
Confirmed
What it is

🚨 An unprivileged user can access freed memory, and that’s a recipe for disaster! This exploit in the Arm Mali GPU driver could let attackers escalate privileges with just a few clever moves. 🔥 Think of it like a restaurant where customers can sneak into the kitchen after a table leaves, rummaging through leftovers that should have been thrown away. They can find all sorts of sensitive recipes and even potentially cook up something dangerous! With this vulnerability, an attacker could expose sensitive information or gain root privileges, effectively turning them into the head chef with full control of the system. This could lead to serious security breaches, letting malicious users wreak havoc on your devices and data!

Put simply

Think of it like a restaurant where customers can sneak into the kitchen after a table leaves, rummaging through leftovers that should have been thrown away. They can find all sorts of sensitive recipes and even potentially cook up something dangerous! This vulnerability in the Arm Mali GPU kernel driver allows unprivileged users to access memory that has already been freed, leading to unauthorized information disclosure or escalation of privileges.

What to do

With this vulnerability, an attacker could expose sensitive information or gain root privileges, effectively turning them into the head chef with full control of the system. This could lead to serious security breaches, letting malicious users wreak havoc on your devices and data! To protect yourself, upgrade to version r30p0 for Bifrost, Valhall, and Midgard. Regularly audit your systems for unpatched drivers and apply security best practices to minimize risk. You've got this! Stay proactive, patch those vulnerabilities, and keep your systems safe! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02988 · 87.2th percentile
Published
2021-05-24T17:56Z
KEV added
2023-07-07 · due 2023-07-28
EPSS history
Timeline
  • 07 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 28
    kev
  • 24 MAY 17:56Z
    CVE-2021-29256
    cvelistv5