CVE-2021-29256

What it actually does

This is a use-after-free vulnerability in the Arm Mali GPU kernel driver. A low-privileged local process can trigger incorrect lifetime handling in the kernel driver and access memory after it has been freed. Successful exploitation can disclose kernel memory and, in some exploit chains, corrupt kernel data structures to gain root-level privileges. The vulnerable driver branches are Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0. Because the bug is in a kernel-mode GPU driver, compromise can bypass application sandboxing on affected devices.

Why it matters to the business

An attacker who already has the ability to run code as an unprivileged user on an affected device can potentially take full control of that device, steal sensitive data, disable security controls, persist with elevated privileges, or use the device as a foothold for additional attacks. This vulnerability is listed in CISA KEV with a remediation due date of 2023-07-28 and has active in-the-wild exploitation, so exposure should be treated as urgent even though the current EPSS score is relatively low and flat at 0.0302 over 30 days. Organizations using Arm-based endpoints, mobile devices, embedded systems, appliances, or Android-derived platforms with affected Mali GPU driver versions should prioritize remediation.

How an attack unfolds

An attacker first obtains a way to execute code as a low-privileged local user, such as through a malicious application, compromised user process, or chained remote-code-execution bug. The attacker then interacts with the Mali GPU kernel driver device interface exposed by the operating system. By driving a vulnerable sequence of GPU memory-management operations, the attacker causes the driver to reference memory that has already been freed. The attacker can use the resulting stale reference to leak kernel memory or manipulate kernel structures. With a reliable exploit, the attacker escalates from an unprivileged account to root or kernel-level control, then may disable defenses, access protected application data, install persistence, or continue lateral activity where the platform supports it. Public in-the-wild exploitation is known, but no specific named APT group is identified in the supplied data.

How to fix it

Update the Arm Mali GPU kernel driver to a fixed release. For Arm driver branches, upgrade Bifrost and Valhall to r30p0 or later; Midgard r28p0 through r30p0 should be updated to the vendor-provided fixed driver or platform firmware containing the corrected Mali driver. For Android and embedded platforms, apply the relevant OEM, SoC vendor, carrier, or device firmware update that includes the patched Mali GPU kernel driver. If the supplied software inventory maps this issue to akka/akka-http source metadata, ensure builds include fixed commits dee7063926b0058989d72a84629a4176ce6f9283 or af9aae88ab045c3bb7096b8c83f66abec48f51fe as applicable, but validate the mapping because the vulnerability itself concerns the Arm Mali kernel driver. Where immediate patching is not possible, reduce local code-execution opportunities, restrict installation of untrusted applications, enforce application allowlisting, harden mobile/endpoint management policy, disable unnecessary GPU access for untrusted workloads where supported, and increase monitoring for local privilege-escalation behavior. Mitigations should not be considered equivalent to patching because exploitation occurs in kernel-mode driver logic.

How to confirm the fix worked

Confirm the deployed Mali GPU kernel driver or platform firmware version is no longer in the vulnerable range. On Linux-derived systems, check loaded modules and driver metadata using platform-appropriate commands such as reading /sys/module/mali_kbase/version, inspecting /proc/modules for mali_kbase, reviewing kernel package versions, or validating the device firmware/security patch level from the vendor. On Android-derived systems, verify the OEM security patch level and kernel/vendor image release notes include the Mali driver fix. If source or build metadata is used, confirm the relevant fixed commits are present in the built artifact. Perform authenticated vulnerability scanning where supported, compare firmware images against vendor advisories, and verify that no affected Bifrost r16p0-r29p0, Valhall r19p0-r29p0, or Midgard r28p0-r30p0 driver remains deployed. After patching, reboot affected systems if required so the fixed kernel driver is loaded.

Typical attack path

1. Gain local code execution on an affected Arm-based device, often through a malicious app, compromised process, or another vulnerability.
2. Confirm the presence of a vulnerable Mali GPU kernel driver version in the affected Bifrost, Valhall, or Midgard ranges.
3. Open and interact with the Mali kernel driver interface, commonly exposed through GPU device nodes such as /dev/mali0 or /dev/mali.
4. Trigger the vulnerable driver object-lifetime condition to create a use-after-free state.
5. Use the freed-memory access to disclose kernel memory and/or corrupt kernel data structures.
6. Escalate privileges to root or kernel-level execution.
7. Perform post-exploitation actions such as credential or data theft, defense evasion, persistence, or further device compromise.

How to detect it

Look for evidence of local privilege escalation and kernel-driver exploitation rather than relying on a single definitive indicator. Useful sources include kernel logs, Android logcat, auditd, EDR telemetry, mobile threat defense telemetry, device management compliance records, crash dumps, SELinux/audit denial logs, process execution logs, and file integrity events. Hunt for untrusted or recently installed applications or user processes that access Mali GPU device nodes followed by crashes, kernel warnings, privilege changes, new root-owned files, disabled security controls, or unexpected process launches as root. In kernel logs, search for Mali driver references near memory-corruption symptoms such as use-after-free, slab corruption, kernel oops, page faults, or KASAN reports. In Android environments, review logcat and tombstones for suspicious native crashes, repeated GPU driver interactions, SELinux denials involving GPU device nodes, and processes gaining elevated privileges outside normal system update or management activity. Because successful kernel local privilege escalation may leave minimal artifacts, absence of logs does not prove absence of exploitation; correlate patch status, app provenance, process lineage, and post-exploitation behavior. Known active exploitation is reported, but the supplied data does not identify a specific named actor, so detections should focus on technique-level artifacts.

• /dev/mali0
• /dev/mali
• /sys/module/mali_kbase/version
• mali_kbase
• mali_kbase.ko
• BUG: KASAN: use-after-free
• use-after-free
• Unable to handle kernel paging request
• Internal error: Oops
• kernel BUG at
• slab-use-after-free
• Call trace: kbase
• kbase_mem
• kbase_ioctl
• kbase_jd
• kbase_gpu
• avc: denied
• u:r:untrusted_app
• name="mali0"
• comm="mali"
• /data/tombstones/tombstone_
• /proc/modules

What your security team should do

• Treat this as a priority remediation item because it is in CISA KEV and has known active exploitation; the KEV due date of 2023-07-28 has passed.
• Inventory Arm Mali GPU driver usage across mobile, endpoint, embedded, appliance, and Android-derived assets, including vendor firmware versions rather than only application package manifests.
• Patch or replace affected devices with vendor firmware containing Mali driver r30p0 or later where applicable, or the OEM’s backported fixed driver.
• Prioritize internet-facing management devices, shared-user devices, BYOD fleets, kiosks, ruggedized devices, and any systems where untrusted users or applications can execute code.
• Hunt for signs of local privilege escalation, kernel crashes, suspicious access to Mali device nodes, and unexpected root processes created by non-system applications.
• Review mobile device management and endpoint controls to block untrusted app installation and enforce current security patch levels.
• If devices cannot be patched, isolate them, remove sensitive workloads, restrict local application execution, and plan replacement.
• Validate any dependency-management finding that maps this issue to akka/akka-http, because the CVE description and remediation concern the Arm Mali GPU kernel driver.