CVE-2021-39793
CVE-2021-39793
Vexday Risk Score
51Attention
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
CVSS 7.8EPSS 0.7%KEV simPoC —Nuclei —Metasploit —Patch —
Lifecycle
16 Mar 2022Published on NVD
11 Apr 2022Active exploitation (CISA KEV)
Recommendation: Patch as soon as possible — active exploitation confirmed.
In short
A logic error in Android's Mali GPU driver allows writing data beyond allocated memory boundaries, enabling attackers to escalate privileges locally without needing special permissions or user interaction.
Technical detail
CVE-2021-39793 is an out-of-bounds write vulnerability (CWE-787) in the kbase_jd_user_buf_pin_pages function of mali_kbase_mem.c. The vulnerability stems from a logic error that permits writing beyond buffer boundaries, allowing local privilege escalation; exploitation requires no additional execution privileges or user interaction.
Summary generated and translated by AI from the official description.
In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Android