CVE-2021-29256
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Description
CVE-2021-29256 is a use-after-free vulnerability in the Arm Mali GPU kernel driver that allows an unprivileged user to access freed memory. This flaw affects the Bifrost, Valhall, and Midgard GPU driver families across multiple versions and can be exploited to achieve information disclosure or escalation to root privileges. Because the Mali GPU driver operates at the kernel level, successful exploitation of CVE-2021-29256 grants an attacker full control over the affected device. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and the EPSS score of 0.64% reflects targeted but real-world exploitation activity against Arm Mali GPU devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| arm | bifrost gpu kernel driver | >= r16p0, < r30p0 |
| arm | midgard gpu kernel driver | >= r28p0, < r31p0 |
| arm | valhall gpu kernel driver | >= r19p0, < r30p0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-29256(US Government Resource)
Weakness Type
CWE-416: Use After Free
In the context of CVE-2021-29256, the Arm Mali GPU kernel driver fails to properly manage memory lifecycle, allowing user-space processes to reference GPU memory objects after they have been freed. This use-after-free condition enables an attacker to manipulate the contents of freed memory and redirect execution flow to achieve privilege escalation or leak sensitive kernel data.
Learn more: CWE-416 — Use After Free
Impact Analysis
With a CVSS v3.1 score of 8.8 (High), CVE-2021-29256 presents a serious security risk for any device using Arm Mali GPUs. The vulnerability requires only low privileges to exploit and needs no user interaction, making it straightforward for a local attacker who has already gained basic access to the device — for example through a malicious application. Confidentiality, integrity, and availability are all rated High, meaning a successful exploit can expose sensitive kernel memory, allow arbitrary code execution with root privileges, and potentially crash the system. While the EPSS score of 0.64% suggests this is not yet massively exploited at scale, the fact that CISA has confirmed active exploitation underscores the urgency of patching, particularly for mobile devices and embedded systems that rely on Mali GPU hardware.
Exploit Maturity
CISA has confirmed that CVE-2021-29256 is actively exploited in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 28, 2023. No public proof-of-concept exploit code has been identified in the available references, but the confirmed active exploitation indicates that threat actors possess working exploits targeting Arm Mali GPU drivers. The EPSS score of 0.64% (70th percentile) suggests exploitation is targeted rather than widespread, likely focusing on high-value mobile and embedded device targets. The ransomware association for this vulnerability is currently listed as unknown.
Remediation
- Apply vendor patches immediately as directed by CISA: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Arm has addressed this vulnerability in driver version r30p0 and later.
- Upgrade Arm Mali GPU kernel drivers to version r30p0 or newer. Specifically, update Bifrost drivers from any version between r16p0 and r29p0, Valhall drivers from r19p0 through r29p0, and Midgard drivers from r28p0 through r30p0 to the patched release.
- Restrict local access to devices running vulnerable Mali GPU drivers by enforcing strong application sandboxing policies and limiting the installation of untrusted applications, which reduces the attack surface for use-after-free exploitation.
- Monitor device logs for signs of privilege escalation attempts, unexpected kernel panics, or anomalous GPU driver behavior that could indicate exploitation of this use-after-free vulnerability.
- Implement memory safety hardening at the kernel level where possible, such as enabling kernel address space layout randomization (KASLR) and heap poisoning features, to make use-after-free exploitation more difficult on devices where immediate patching is not feasible.
Technical Details
CVE-2021-29256 stems from a use-after-free (CWE-416) condition in the Arm Mali GPU kernel driver, where memory objects used by the GPU are freed but pointers to those objects remain accessible to user-space processes. An attacker with low-level privileges on the device can trigger the deallocation of a GPU memory buffer and then reallocate the same memory region with attacker-controlled data, effectively hijacking kernel data structures. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that while low privileges are required, the attack complexity is low and no user interaction is needed, making exploitation reliable once an attacker has local code execution. The vulnerability affects three distinct GPU driver families — Bifrost (r16p0 through r29p0), Valhall (r19p0 through r29p0), and Midgard (r28p0 through r30p0) — all sharing common kernel driver code paths where the memory management flaw resides, enabling either information disclosure through reading freed kernel memory or full root privilege escalation through function pointer corruption.
Frequently Asked Questions
Is CVE-2021-29256 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2021-29256 by adding it to the Known Exploited Vulnerabilities (KEV) catalog. The remediation deadline was set for July 28, 2023. While the ransomware association is listed as unknown, the confirmed exploitation means organizations should prioritize patching immediately.
What products are affected by CVE-2021-29256?
CVE-2021-29256 affects Arm Mali GPU kernel drivers across three product families: Bifrost (versions r16p0 through r29p0), Valhall (versions r19p0 through r29p0), and Midgard (versions r28p0 through r30p0). These GPU drivers are widely used in mobile devices, Chromebooks, and embedded systems from various manufacturers.
How do I fix CVE-2021-29256?
The primary fix is to upgrade the Arm Mali GPU kernel driver to version r30p0 or later, which addresses the use-after-free vulnerability. Device manufacturers and OEMs should obtain the patched driver from Arm and distribute firmware updates to affected devices. Until patching is possible, restrict untrusted application installations and enable kernel-level memory safety features.
How severe is CVE-2021-29256?
CVE-2021-29256 has a CVSS v3.1 score of 8.8, rated as High severity. The vulnerability allows an attacker with low privileges to achieve full root access through a use-after-free condition in the GPU kernel driver. Its EPSS score places it in the 70th percentile, indicating meaningful exploitation probability, and its inclusion in the KEV catalog confirms real-world impact.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.