CVE-2021-28664

CVE-2021-28664 is an out-of-bounds write (CWE-787) in the Arm Mali GPU kernel driver that allows an unprivileged user to gain read/write access to pages that should be read-only, producing memory corruption that can lead to privilege escalation or a denial-of-service crash. It is triggered when an unprivileged local process (for example, an app on an Android device using a Mali GPU) interacts with the vulnerable GPU kernel driver, and the flaw is rated CVSS 3.1 8.8 (High) with low attack complexity and low privileges required. A successful attacker gains privileged access with high impact to confidentiality, integrity, and availability, or can crash the affected device. Anyone running the Bifrost (r0p0 through r29p0), Valhall (r19p0 through r29p0), or Midgard (r8p0 through r30p0) GPU kernel drivers is affected, most commonly Android smartphones and tablets built on SoCs with Mali GPUs. Exploitation is confirmed in the wild: CISA added the CVE to the KEV catalog on 2021-11-03, related headlines indicate Arm Mali fixes shipped in recent Android security updates amid active targeted attacks, EPSS estimates a 5.4% chance of exploitation in the next 30 days, and ransomware use is unknown.

What to do: Upgrade the Arm Mali GPU kernel driver to Bifrost r30p0 or later, Valhall r30p0 or later, or Midgard r31p0 or later; because most users receive the fixed driver through device firmware, apply the latest vendor/Android security updates per vendor instructions and verify the installed Mali driver revision on each affected device. As this vulnerability is on the CISA KEV catalog with confirmed in-the-wild exploitation, prioritize patching affected fleets, and until patched, restrict untrusted apps or unprivileged users from running on vulnerable Mali-based devices.