PT-2024-30627 · Imagination Technologies · Imagination Technologies Graphics Ddk

Published 2024-10-14 · Updated 2024-12-03 · CVE-2024-43701

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Imagination Technologies Graphics DDK (affected versions not specified)

Description The issue allows software installed and run as a non-privileged user to conduct GPU system calls, enabling the reading and writing of freed physical memory from the GPU. This is due to a use-after-free (UAF) condition related to the TLB invalidate of dma buf imported into multiple GPU devices, which can lead to a potential race condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Race Condition

Weakness Enumeration

CWE-416

CWE-362

Related Identifiers

CVE-2024-43701

Affected Products

Imagination Technologies Graphics Ddk

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-43701 · Security Note
• https://twitter.com/VulmonFeeds/status/1845773869207937313 · Twitter Post
• https://twitter.com/cracbot/status/1847518093616337004 · Twitter Post
• https://twitter.com/xvonfers/status/1845775459277066535 · Twitter Post
• https://twitter.com/vuldb/status/1845759961726673286 · Twitter Post
• https://imaginationtech.com/gpu-driver-vulnerabilities · Note
• https://t.me/cvedetector/7802 · Telegram Post
• https://t.me/cvenotify/97979 · Telegram Post
• https://twitter.com/cracbot/status/1846793354534953367 · Twitter Post
• https://twitter.com/CVEnew/status/1845747627021013112 · Twitter Post
• https://t.me/cvenotify/98114 · Telegram Post
• https://reddit.com/r/k12cybersecurity/comments/1h5oefs/msisac_cybersecurity_advisory_multiple · Reddit Post