Buffer overflow in Google Android - CVE-2021-28664
Published: May 20, 2021
Vulnerability identifier: #VU53390
CSH Severity: High
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-28664
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Arm Mali GPU kernel driver. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r8p0 through r30p0. A local application can trigger memory corruption and execute arbitrary code on the system with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Google Android
How to mitigate CVE-2021-28664
Install updates from vendor's website.
Google Android - addressed in versions 8.1 2021-05-05, 9.0 2021-05-05, 10 2021-05-05, 11 2021-05-05