{"metadata": {"vulnerability": "cve-2021-28664", "count": 48, "kinds": {"milestone": 5, "sighting": 14, "kev": 11, "other": 18}}, "data": [{"timestamp": "2021-03-18T00:00:00Z", "date_only": false, "value": "2021-03-18T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2021-28664", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-05-04T00:00:00Z", "date_only": false, "value": "2021-05-04T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-337", "record": "CERTFR-2021-AVI-337", "field": "revisions.0.revision_date"}, {"timestamp": "2021-05-10T00:00:00Z", "date_only": false, "value": "2021-05-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2021-28664", "field": "cveMetadata.datePublished"}, {"timestamp": "2021-05-10T15:15:00Z", "date_only": false, "value": "2021-05-10T15:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-W62F-9GM7-596F", "record": "GHSA-W62F-9GM7-596F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-05-10T15:15:07.590Z", "date_only": false, "value": "2021-05-10T15:15:07.590", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-28664", "record": "FKIE_CVE-2021-28664", "field": "published"}, {"timestamp": "2021-05-10T15:15:07.590Z", "date_only": false, "value": "2021-05-10T15:15:07.590", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2021-28664", "record": "GSD-2021-28664", "field": "namespaces.nvd.nist.gov.cve.published"}, {"timestamp": "2021-05-21T00:00:00Z", "date_only": true, "value": "2021-05-21", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2021-36597", "record": "CNVD-2021-36597", "field": "submitTime"}, {"timestamp": "2021-05-24T00:00:00Z", "date_only": true, "value": "2021-05-24", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2021-36597", "record": "CNVD-2021-36597", "field": "openTime"}, {"timestamp": "2021-06-08T17:52:38Z", "date_only": false, "value": "2021-06-08T17:52:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/androidMalware/1217", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "8f7e5689-19fb-4375-a1a5-03ccb578c10c", "content": "Four Android vulnerabilities patched earlier this month may be under limited, targeted exploitation (CVE-2021-1905, CVE-2021-1906, CVE-2021-28663, CVE-2021-28664)\nhttps://therecord.media/arm-and-qualcomm-zero-days-quietly-patched-in-this-months-android-security-updates/", "url": "https://t.me/androidMalware/1217"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-28664", "field": "timestamps.asserted_at", "uuid": "eb59cea1-7647-4d4b-a9ac-157f73de8e8d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-28664", "field": "timestamps.asserted_at", "uuid": "03193b7b-f5bc-4bef-8b3b-28fadfc1d0a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-28664", "field": "containers.adp.1.metrics.2.other.content.dateAdded"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2021-28664", "record": "GSD-2021-28664", "field": "namespaces.cisa.gov.dateAdded"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-28664", "field": "evidence.0.details.added_date", "uuid": "03193b7b-f5bc-4bef-8b3b-28fadfc1d0a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-28664", "field": "evidence.0.details.date_added", "uuid": "eb59cea1-7647-4d4b-a9ac-157f73de8e8d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-28664", "field": "timestamps.first_seen_at", "uuid": "eb59cea1-7647-4d4b-a9ac-157f73de8e8d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-28664", "field": "timestamps.first_seen_at", "uuid": "03193b7b-f5bc-4bef-8b3b-28fadfc1d0a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-28664", "field": "status.status_updated_at", "uuid": "eb59cea1-7647-4d4b-a9ac-157f73de8e8d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-28664", "field": "status.status_updated_at", "uuid": "03193b7b-f5bc-4bef-8b3b-28fadfc1d0a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-28664", "field": "containers.adp.1.timeline.0.time"}, {"timestamp": "2021-11-08T08:58:17Z", "date_only": false, "value": "2021-11-08T08:58:17.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "0e483c25-1b2e-4af2-9331-3d365aa81713"}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-28664", "field": "evidence.0.details.due_date", "uuid": "eb59cea1-7647-4d4b-a9ac-157f73de8e8d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2021-28664", "record": "GSD-2021-28664", "field": "namespaces.cisa.gov.dueDate"}, {"timestamp": "2021-11-20T09:53:52Z", "date_only": false, "value": "2021-11-20T09:53:52.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "3847bb34-fa0f-4219-a241-fa5765548d67"}, {"timestamp": "2022-04-27T11:03:23Z", "date_only": false, "value": "2022-04-27T11:03:23.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/androidMalware/1514", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "da22e3b4-79df-4858-86d3-48825437949a", "content": "A Year in Review of 0-days Used In-the-Wild in 2021 by Google\nIn 2021 there were 7 #Android in-the-wild 0-days detected and disclosed:\n - Qualcomm Adreno GPU driver (CVE-2020-11261, CVE-2021-1905, CVE-2021-1906)\n - ARM Mali GPU driver (CVE-2021-28663, CVE-2021-28664)\n - Upstream Linux kernel (CVE-2021-1048, CVE-2021-0920)\n\nFor the 5 total #iOS and macOS in-the-wild 0-days, they targeted 3 different attack surfaces:\n - IOMobileFrameBuffer (CVE-2021-30807, CVE-2021-30883)\n - XNU Kernel (CVE-2021-1782 & CVE-2021-30869)\n - CoreGraphics (CVE-2021-30860)\n - CommCenter (FORCEDENTRY sandbox escape - CVE requested, not yet assigned)\nhttps://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html", "url": "https://t.me/androidMalware/1514"}, {"timestamp": "2022-05-24T19:01:54Z", "date_only": false, "value": "2022-05-24T19:01:54Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-W62F-9GM7-596F", "record": "GHSA-W62F-9GM7-596F", "field": "published"}, {"timestamp": "2022-10-27T00:00:00Z", "date_only": false, "value": "2022-10-27T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "cve-2021-28664", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2023-12-05T01:53:45Z", "date_only": false, "value": "2023-12-05T01:53:45.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1361", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "94b48467-241d-4f7e-a0ee-e7353df95a13", "content": "#ExploitObserverAlert\n\nCVE-2021-28664\n\nDESCRIPTION: Exploit Observer has 8 entries related to CVE-2021-28664. The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0 through r30p0 before r31p0.\n\nFIRST-EPSS: 0.004200000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/1361"}, {"timestamp": "2023-12-13T01:23:29.533Z", "date_only": false, "value": "2023-12-13T01:23:29.533831Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-28664", "record": "GSD-2021-28664", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-13T13:51:52.563Z", "date_only": false, "value": "2023-12-13T13:51:52.563", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-28664", "record": "GSD-2021-28664", "field": "namespaces.nvd.nist.gov.cve.lastModified"}, {"timestamp": "2024-08-03T21:47:33.056Z", "date_only": false, "value": "2024-08-03T21:47:33.056Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2021-28664", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-11-14T06:09:01Z", "date_only": false, "value": "2024-11-14T06:09:01.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/6ce6c946-ebd2-4185-9349-c6d62f7a4f01", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "95c90426-3910-4976-916c-cd0bf57ad9bb"}, {"timestamp": "2024-12-24T20:24:36.128Z", "date_only": false, "value": "2024-12-24T20:24:36.128416Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971124", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "6dd9cf1e-0440-4c2c-ad84-ef2656dbade0", "url": "https://feedsin.space/feed/CISAKevBot/items/2971124"}, {"timestamp": "2025-02-03T14:36:45.829Z", "date_only": false, "value": "2025-02-03T14:36:45.829744Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-28664", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-02-03T14:36:45.829Z", "date_only": false, "value": "2025-02-03T14:36:45.829744Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-28664", "record": "FKIE_CVE-2021-28664", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-02-23T02:09:54Z", "date_only": false, "value": "2025-02-23T02:09:54.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "5144db4c-7a4a-40bc-9a22-056d1a5741a2"}, {"timestamp": "2025-10-21T23:25:46.137Z", "date_only": false, "value": "2025-10-21T23:25:46.137Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2021-28664", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:25:46.137Z", "date_only": false, "value": "2025-10-21T23:25:46.137Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-28664", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:32:13Z", "date_only": false, "value": "2025-10-22T00:32:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-W62F-9GM7-596F", "record": "GHSA-W62F-9GM7-596F", "field": "modified"}, {"timestamp": "2026-02-02T12:25:39Z", "date_only": false, "value": "2026-02-02T12:25:39+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-28664", "field": "timestamps.recorded_at", "uuid": "eb59cea1-7647-4d4b-a9ac-157f73de8e8d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-02T12:28:38.950Z", "date_only": false, "value": "2026-02-02T12:28:38.950508Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/eb59cea1-7647-4d4b-a9ac-157f73de8e8d", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "f42f25b5-85cd-4371-9c6e-c4b8ac780f04", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/eb59cea1-7647-4d4b-a9ac-157f73de8e8d"}, {"timestamp": "2026-06-17T03:46:43.977Z", "date_only": false, "value": "2026-06-17T03:46:43.977", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-28664", "record": "FKIE_CVE-2021-28664", "field": "lastModified"}, {"timestamp": "2026-06-19T12:47:57.001Z", "date_only": false, "value": "2026-06-19T12:47:57.001705Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/40d86d70-96bc-4223-bb38-0ffd84ae474c", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "baff513a-217d-44db-bc5d-836513ca32f6", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/40d86d70-96bc-4223-bb38-0ffd84ae474c"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-28664", "field": "timestamps.recorded_at", "uuid": "03193b7b-f5bc-4bef-8b3b-28fadfc1d0a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:04:46.476Z", "date_only": false, "value": "2026-06-23T14:04:46.476472Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/03193b7b-f5bc-4bef-8b3b-28fadfc1d0a3", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "1bd6d638-8e74-444d-9489-bb7268464cdf", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/03193b7b-f5bc-4bef-8b3b-28fadfc1d0a3"}, {"timestamp": "2026-09-01T18:00:05.139Z", "date_only": false, "value": "2026-09-01T18:00:05.139115Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hackersmeet0/2446", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "fe19c666-503c-47c5-a075-779f19edb6ec", "content": "Four Android vulnerabilities patched earlier this month may be under limited, targeted exploitation (CVE-2021-1905, CVE-2021-1906, CVE-2021-28663, CVE-2021-28664)\nhttps://therecord.media/arm-and-qualcomm-zero-days-quietly-patched-in-this-months-android-security-updates/", "url": "https://t.me/hackersmeet0/2446"}, {"timestamp": "2026-09-01T20:01:32.961Z", "date_only": false, "value": "2026-09-01T20:01:32.961004Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/63752", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "b26b8115-6f13-4952-be5f-0b9d3cff7e38", "content": "hacking: security in practice\nAnyone know where I can find a PoC for CVE-2021-28664\n\nI have a Hisense U8G with Android 10 kernel version 4.19.75 with a 32 bit userland. Already unlocked the bootloader, but the firmware package is encrypted with a key that I can only get after rooting.\n\nI need some other way to dump my boot.img and the kernel is too old for DirtyPipe and too new for mtk-su. The exploit in the title should work for me, but I can't find any PoC to run.\n\nI just need temp root basically\n\nsubmitted by /u/WeedyPests \n[link] [comments]", "url": "https://t.me/hacking_Attack/63752"}, {"timestamp": "2026-09-14T03:00:11.968Z", "date_only": false, "value": "2026-09-14T03:00:11.968601Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ZDsKk6umJ3OlCagGo0wD54oo8d8XbKXnBjolAPHYcDQ0RXY", "record": "CVE-2021-28664", "field": "creation_timestamp", "uuid": "aa009318-5e06-4a24-90cf-7fad64afcbcb"}]}