CVE-2021-29256
HighActively exploited (CISA KEV)
Description
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Arm Mali Graphics Processing Unit (GPU)
PublishedMay 24, 2021
First seenMay 24, 2021
Added to KEVJul 7, 2023
Weakness typeCWE-416Use after free
How to fix
CISA required action
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CISA due date: Jul 28, 2023Update
- arm bifrost_gpu_kernel_driverr30p0 or later
- arm midgard_gpu_kernel_driverr31p0 or later
- arm valhall_gpu_kernel_driverr30p0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arm bifrost_gpu_kernel_driver | r16p0 ≤ v < r30p0 | r30p0 |
| arm midgard_gpu_kernel_driver | r28p0 ≤ v < r31p0 | r31p0 |
| arm valhall_gpu_kernel_driver | r19p0 ≤ v < r30p0 | r30p0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.