PT-2024-30630 · Imagination Technologies · Powervr

Published 2024-11-17 · Updated 2024-11-21 · CVE-2024-43704

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PowerVR (affected versions not specified)

Description The issue allows software installed and run as a non-privileged user to conduct improper GPU system calls, potentially gaining access to the graphics buffers of a parent process. This is related to the PVRSRVAcquireProcessHandleBase() function, which can cause psProcessHandleBase reuse when PIDs are reused, leading to exposure of resources to the wrong sphere.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2024-43704

Affected Products

Powervr

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-43704 · Security Note
• https://twitter.com/xvonfers/status/1859699344943022399 · Twitter Post
• https://imaginationtech.com/gpu-driver-vulnerabilities · Note
• https://twitter.com/xvonfers/status/1858459030928118105 · Twitter Post
• https://t.me/cvenotify/101991 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1858404084178457045 · Twitter Post
• https://t.me/cvedetector/11280 · Telegram Post
• https://t.me/cvenotify/101952 · Telegram Post
• https://twitter.com/CVEnew/status/1858379009912160410 · Twitter Post