Critical Privilege Escalation in Arm Mali GPU Kernel Driver (CVE‑2021‑28664)
What It Is — The Arm Mali GPU kernel driver contains an unspecified vulnerability that can allow a non‑privileged user to write to read‑only memory, gain root privileges, corrupt memory, and tamper with other processes.
Exploitability — Listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild; CVSS v3.1 base score 8.8 (High).
Affected Products — Arm Mali GPU kernel driver used in a wide range of Android, embedded, and IoT devices that incorporate Arm’s Mali graphics processors.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous patch‑management evidence to prove that privileged‑access controls are kept up‑to‑date.
- Highlights the importance of monitoring for unauthorized privilege‑escalation attempts as part of an audit‑ready control set.
- Provides a concrete test of the “least‑privilege” control objective that maps to multiple frameworks (e.g., NIST CSF, ISO 27001).
Recommended Actions
- Inventory all devices that ship with an Arm Mali GPU and verify driver version.
- Apply Arm‑provided patches or firmware updates immediately; document the remediation as control evidence.
- Enable runtime integrity monitoring to detect unexpected memory writes or privilege changes.
- Incorporate the patch‑status check into your continuous compliance dashboard.
Source: CISA KEV – CVE‑2021‑28664