Use‑After‑Free in Arm Mali GPU Driver (CVE‑2021‑28663) Enables Privilege Escalation
What It Is – The kernel driver for Arm’s Mali graphics processing unit contains a use‑after‑free flaw that can be triggered by a non‑privileged user. Successful exploitation may allow arbitrary memory operations, leading to root‑level privilege escalation or information disclosure.
Exploitability – Publicly disclosed; proof‑of‑concept code is available. CVSS v3.1 base score: 8.8 (High).
Affected Products – Arm Mali GPU kernel driver (all platforms shipping the driver prior to the vendor‑released patch).
Why It Matters for Trust & Control Assurance
- Access‑control assurance – The vulnerability bypasses OS‑level privilege boundaries, highlighting the need for continuous verification that only authorized code runs with elevated rights.
- Patch‑management evidence – Demonstrating timely remediation (patch deployment, firmware version tracking) provides defensible audit evidence for control objectives around vulnerability remediation.
- Continuous monitoring – Real‑time detection of anomalous GPU activity (unexpected memory writes, privilege changes) supports a trustworthy security posture that regulators and enterprise buyers increasingly demand.
Recommended Actions
- Inventory all devices running the Arm Mali GPU driver and verify the driver version.
- Apply the vendor‑supplied patch or upgrade to a driver version that addresses CVE‑2021‑28663.
- Enable logging of GPU‑related syscalls and monitor for abnormal privilege‑escalation attempts.
- Capture remediation evidence (patch version, log snapshots) for audit readiness.
- Incorporate the patch‑status check into your continuous control‑mapping workflow.
Source: CISA KEV – CVE‑2021‑28663