CVE-2021-29256: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
Other sources
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If vendor updates are unavailable, discontinue use of the affected Arm Mali GPU Kernel Driver builds: Bifrost r16p0 through r29p0 (before r30p0); Valhall r19p0 through r29p0 (before r30p0); Midgard r28p0 through r30p0.
Event History
Frequently Asked Questions
What is CVE-2021-29256?
CVE-2021-29256 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver that could allow a non-privileged user to gain root privileges and/or disclose information.
Who is affected by CVE-2021-29256?
The vulnerability affects devices using the Arm Mali Graphics Processing Unit (GPU) and Google Android.
What is the severity of CVE-2021-29256?
CVE-2021-29256 has a high severity level with a CVSS score of 7.
How can CVE-2021-29256 be exploited?
The vulnerability can be exploited by a non-privileged user to gain root privilege and/or disclose information.
How can I fix CVE-2021-29256?
You should update your Arm Mali GPU Kernel Driver to the latest version available and install any relevant patches provided by your device manufacturer.