CVE-2021-29256: Arm Bifrost GPU Privilege Escalation Flaw

CVE-2021-29256 Overview

CVE-2021-29256 is a critical use-after-free vulnerability in the Arm Mali GPU kernel driver that allows an unprivileged user to achieve access to freed memory. This vulnerability can lead to information disclosure or root privilege escalation on affected devices, posing a severe security risk to systems utilizing Arm Mali GPUs.

Critical Impact
This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation enables attackers to escalate privileges to root or leak sensitive kernel memory.

Affected Products

Arm Bifrost GPU Kernel Driver r16p0 through r29p0 (before r30p0)
Arm Valhall GPU Kernel Driver r19p0 through r29p0 (before r30p0)
Arm Midgard GPU Kernel Driver r28p0 through r30p0

Discovery Timeline

2021-05-24 - CVE-2021-29256 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-29256

Vulnerability Analysis

The vulnerability resides in the Mali GPU kernel driver's memory management subsystem. When GPU memory objects are freed, the driver fails to properly invalidate all references to the freed memory regions. This creates a condition where an unprivileged user can continue to access memory that has already been deallocated and potentially reallocated for other purposes.

The flaw can be exploited in two primary ways: first, by reading freed memory that may now contain sensitive kernel data (information disclosure), and second, by manipulating the contents of freed memory before it gets reallocated, potentially allowing an attacker to corrupt kernel data structures and achieve privilege escalation to root.

This vulnerability is classified as CWE-416 (Use After Free), a memory safety issue where a program continues to use a pointer after it has been freed.

Root Cause

The root cause of CVE-2021-29256 stems from improper memory lifecycle management within the Mali GPU kernel driver. When memory objects associated with GPU operations are freed, the kernel driver does not adequately track and invalidate all dangling pointers or references to the freed memory regions. This allows subsequent operations to inadvertently or intentionally access memory that is no longer valid for the original context.

The affected driver versions across Bifrost, Valhall, and Midgard architectures share common memory management code paths where this vulnerability manifests, indicating a systemic issue in the driver's memory handling logic.

Attack Vector

An attacker with local access to a system running a vulnerable Mali GPU driver can exploit this vulnerability without requiring elevated privileges. The attack involves:

Triggering GPU memory allocations through normal GPU API calls
Manipulating the timing and sequence of memory allocation and deallocation operations
Exploiting the race condition to access freed memory regions
Reading sensitive kernel memory for information disclosure, or corrupting memory structures to achieve privilege escalation

The vulnerability's severity is amplified by the fact that Mali GPUs are widely deployed in mobile devices, embedded systems, and ARM-based computing platforms, creating a large attack surface for malicious actors targeting these devices.

Detection Methods for CVE-2021-29256

Indicators of Compromise

Unusual kernel memory access patterns from GPU-related processes
Unexpected privilege escalation events on systems with Mali GPUs
Kernel crashes or instability related to Mali GPU driver operations
Suspicious processes attempting to interact with GPU memory management interfaces

Detection Strategies

Monitor for unusual GPU driver behavior using kernel auditing tools
Implement memory integrity monitoring to detect use-after-free exploitation attempts
Deploy endpoint detection solutions capable of identifying kernel-level exploitation
Review system logs for Mali GPU driver-related errors or anomalies

Monitoring Recommendations

Enable kernel audit logging for GPU subsystem interactions
Implement real-time monitoring for privilege escalation attempts
Configure alerting for unusual memory access patterns in kernel space
Regularly review device driver logs for Mali GPU components

How to Mitigate CVE-2021-29256

Immediate Actions Required

Update Mali GPU kernel drivers to version r30p0 or later immediately
Audit all systems with Arm Mali GPUs (Bifrost, Valhall, Midgard architectures) for vulnerable driver versions
Prioritize patching given the known exploitation status and CISA KEV listing
Implement additional access controls to limit GPU driver interactions on critical systems

Patch Information

Arm has released patched versions of the Mali GPU kernel drivers that address this vulnerability. The fix is available in:

Bifrost GPU Kernel Driver r30p0 and later
Valhall GPU Kernel Driver r30p0 and later
Midgard GPU Kernel Driver - consult Arm Security Updates for specific remediation guidance

Device manufacturers and vendors should integrate the updated drivers into their firmware updates. End users should apply all available system and firmware updates from their device vendors.

For detailed patch information and driver downloads, refer to the Arm Mali GPU Kernel Driver Security Updates.

Workarounds

Restrict local access to systems with vulnerable Mali GPU drivers where possible
Implement strict application sandboxing to limit GPU driver access
Monitor and limit which processes can interact with GPU subsystems
Consider disabling non-essential GPU functionality on high-security systems until patching is complete

bash

# Check current Mali GPU driver version (Linux)
# Method varies by device - example for checking kernel module info
modinfo mali_kbase 2>/dev/null | grep -i version

# Alternative: Check dmesg for Mali driver information
dmesg | grep -i mali | grep -i version