CVE-2021-29256

published 2021-05-24

CVE-2021-29256: . The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation…

Priority P1 82 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

KEV ITW

. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
arm	bifrost_gpu_kernel_driver	>= r16p0 < r30p0	r30p0
arm	midgard_gpu_kernel_driver	>= r28p0 < r31p0	r31p0
arm	valhall_gpu_kernel_driver	>= r19p0 < r30p0	r30p0
google	android	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Target is the Arm Mali GPU kernel driver; look for unprivileged processes interacting with Mali GPU kernel driver interfaces (Bifrost, Valhall, Midgard) that result in use-after-free conditions leading to privilege escalation or memory disclosure. ↗
• → Flag any process running at low privilege that subsequently gains root — particularly on Android devices with Mali GPUs — as a potential exploitation indicator for this UAF vulnerability. ↗
• → Scope detection to Mali GPU driver versions: Bifrost r16p0–r29p0, Valhall r19p0–r29p0, and Midgard r28p0–r30p0 (all before r30p0 fix). Audit installed driver versions on Android/Linux devices with Mali GPUs. ↗
• → Android Security Bulletin reference A-283489460 can be used to cross-reference patched builds; devices missing the 2023-07-01 Android security patch level on Mali-equipped hardware remain vulnerable. ↗

• · Midgard r30p0 is listed as an affected version (not a fixed version), unlike Bifrost and Valhall where r30p0 is the fix. Ensure detection/patching scope correctly distinguishes Midgard r28p0–r30p0 as all vulnerable. ↗
• · The Android Security Bulletin entry is marked with an asterisk (*) on the reference A-283489460, which typically indicates the patch is not publicly available — verify patch availability through OEM channels before assuming remediation. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

vulncheck 8.8 HIGH

cisa 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416