CVE DatabaseCVE-2021-39793

Updated 2026-06-17한국어 권고문 →

CVE-2021-397937.8/HIGHCISA KEVCWE-787CWE-787

Android Kernel ARM Mali GPU Driver Out-of-Bounds Write Vulnerability (CVE-2021-39793) Technical Analysis and Remediation Guide

⚡ Jump to Patch

Affected Vendors

google, arm

Affected Components

android, mali_gpu_driver

Published Date

2022-03-16

CVSS v3.1

7.8

HIGH

EPSS (30d)

0.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Android devices powered by kernels utilizing the ARM Mali GPU driver

Impact

Local attackers can achieve local privilege escalation (LPE) to kernel execution context without any user interaction

Mitigation

Apply the March 2022 or later Android Security Patch Level (SPL) and update the kernel build

Affected Products & Version Scope

Android devices running kernels with the ARM Mali GPU driver prior to the March 2022 security update

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

To remediate this vulnerability, update the Android system to Security Patch Level (SPL) 2022-03-01 or later. For custom kernel builds, sync with the latest secure AOSP branch and rebuild the kernel image:

bash

# Navigate to kernel source directory and sync with secure branch
cd /path/to/android/kernel
git fetch upstream
git checkout android-12.0.0_r0.31 # Or the appropriate secure tag for your device

# Rebuild the kernel
make ARCH=arm64 defconfig
make ARCH=arm64 -j$(nproc)

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict local attack vectors by disabling ADB debugging and blocking sideloaded applications via MDM or ADB commands:

bash

# Disable ADB debugging on the target device
adb shell settings put global adb_enabled 0

# Prevent installation of applications from untrusted sources
adb shell settings put secure install_non_market_apps 0

3. Log Audit & IoC Verification Commands

Use the following shell script to verify the current security patch level and determine vulnerability status on connected devices:

bash

#!/system/bin/sh
# Check the Android Security Patch Level via shell

PATCH_LEVEL=$(getprop ro.build.version.security_patch)
echo 'Current Security Patch Level:' $PATCH_LEVEL

# Compare patch level with the remediation target date (2022-03-01)
if [ '$(date -d '$PATCH_LEVEL' +%s)' -lt '$(date -d '2022-03-01' +%s)' ]; then
  echo '[WARNING] Device is vulnerable to CVE-2021-39793. Immediate update required.'
else
  echo '[INFO] Device patch level is secure.'
fi

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active exploitation in the wild (CISA KEV), immediately update all affected Android endpoints to the March 2022 security patch level or later.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-39793) is an out-of-bounds write flaw located within the kbase_jd_user_buf_pin_pages function of mali_kbase_mem.c in the ARM Mali GPU kernel driver. A logic error in the driver's memory management code fails to properly validate boundaries when pinning user-space buffers into kernel memory pages, allowing an attacker to write data outside the allocated buffer limits.

2. Exploitation Mechanics & Attack Scenario

A local attacker with basic execution privileges can trigger this vulnerability by invoking specific ioctl system calls targeting the Mali GPU driver. When kbase_jd_user_buf_pin_pages processes the request, the logic error allows the attacker to corrupt adjacent kernel memory structures. Because this exploit requires zero user interaction, it can be fully automated by a malicious local application to hijack the kernel execution flow.

3. Infrastructure & Business Impact

As a vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, this flaw poses a severe and active threat. Successful exploitation bypasses the Android application sandbox entirely, granting the attacker root or kernel-level privileges. This compromises the entire device integrity, leading to unauthorized access to sensitive data, credential theft, and potential persistent device compromise.

Official Vendor Advisories & References

NVD Original English Description

In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A

https://source.android.com/security/bulletin/pixel/2022-03-01

Source: security@android.com · Vendor Advisory

https://source.android.com/security/bulletin/pixel/2022-03-01

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39793

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory, US Government Resource

Frequently Asked SecOps Questions (CVE-2021-39793)

FAQ

Q1. How critical is CVE-2021-39793 and is it actively exploited in the wild?

CVE-2021-39793 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 0.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-39793?

Primary impacted vendors include google, arm across android, mali_gpu_driver. Scope summary: Android devices running kernels with the ARM Mali GPU driver prior to the March 2022 security update

Q3. What temporary mitigations or workarounds exist for CVE-2021-39793 before patching?

[Mitigation] Apply the March 2022 or later Android Security Patch Level (SPL) and update the kernel build Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION