CVE-2021-28663

2021-05-1000:00:00

mitre

github.com

arm

mali

gpu

kernel

driver

vulnerability

privilege escalation

information disclosure

use-after-free

bifrost

valhall

midgard

AI Score

6.8

Confidence

Low

EPSS

0.016

Percentile

87.6%

SSVC

Exploitation

active

Automatable

Technical Impact

total

JSON

The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:arm:bifrost_gpu_kernel_driver:-:*:*:*:*:*:*:*"
    ],
    "vendor": "arm",
    "product": "bifrost_gpu_kernel_driver",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "r28p0"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:arm:valhall_gpu_kernel_driver:-:*:*:*:*:*:*:*"
    ],
    "vendor": "arm",
    "product": "valhall_gpu_kernel_driver",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "r28p0"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:arm:midgard_gpu_kernel_driver:-:*:*:*:*:*:*:*"
    ],
    "vendor": "arm",
    "product": "midgard_gpu_kernel_driver",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "r30p0"
      }
    ],
    "defaultStatus": "unknown"
  }
]