Actively exploited · Published May 24, 2021 · Assigned by mitre
CVE-2021-29256
High 8.8 Exploited
In plain English
A high-severity use-after-free in Mali Graphics Processing Unit (GPU) from Arm. Attackers are actively exploiting it in the wild (listed by CISA on July 7, 2023). The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CISA guidance
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Federal agencies must remediate by Jul 28, 2023.
Official description
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H