CVE-2021-28664
Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
Description
CVE-2021-28664 is a high-severity vulnerability affecting Arm Mali Graphics Processing Unit (GPU). Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 0.14% (33.7th percentile), this vulnerability has a measurable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| arm | bifrost gpu kernel driver | >= r0p0, < r29p0 |
| arm | midgard gpu kernel driver | >= r8p0, < r31p0 |
| arm | valhall gpu kernel driver | >= r19p0, < r29p0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities(Vendor Advisory)
- https://developer.arm.com/support/arm-security-updates(Vendor Advisory)
- https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28664(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write (CWE-787) occurs when software writes data past the boundaries of the intended buffer. This can corrupt adjacent memory, crash the application, or allow an attacker to execute arbitrary code. Out-of-bounds write vulnerabilities are among the most commonly exploited weakness types and are frequently found in firmware and kernel-level components where memory safety is critical.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-28664 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a high-severity threat. The vulnerability is exploitable over the network with low attack complexity, requires low-level privileges, without user interaction. Successful exploitation can severely compromise data confidentiality, allow unauthorized modification of data and systems, and cause complete service disruption. Organizations running affected deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2021-28664 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.14% (33.7th percentile) indicates a measurable probability of exploitation. While not currently associated with known ransomware campaigns, the confirmed exploitation status demands immediate attention. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (arm bifrost gpu kernel driver (>= r0p0, < r29p0), arm midgard gpu kernel driver (>= r8p0, < r31p0), arm valhall gpu kernel driver (>= r19p0, < r29p0)) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2021-28664 affects Arm Mali Graphics Processing Unit (GPU). The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0 through r30p0 before r31p0. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The CVSS score of 8.8 reflects the combination of low exploitability and severe impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2021-28664 being actively exploited?
Yes. CVE-2021-28664 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 0.14% (33.7th percentile) further indicates a measurable exploitation probability.
What products are affected by CVE-2021-28664?
CVE-2021-28664 affects Arm Mali Graphics Processing Unit (GPU). Specifically affected products include: arm bifrost gpu kernel driver (>= r0p0, < r29p0), arm midgard gpu kernel driver (>= r8p0, < r31p0), arm valhall gpu kernel driver (>= r19p0, < r29p0).
How do I fix CVE-2021-28664?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2021-28664?
CVE-2021-28664 has a CVSS 3.1 score of 8.8 (HIGH). This is a high-severity vulnerability that requires immediate attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.