PT-2025-2780 · Unknown · Graphics Ddk

Published 2025-01-13 · Updated 2025-01-16 · CVE-2024-47894

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Graphics DDK version <= 24.2 RTM2

Description: The kernel software installed and running inside a guest virtual machine (VM) can send improper commands to the GPU firmware, allowing it to read data outside the guest's virtualized GPU memory. This issue may potentially affect a significant number of devices worldwide, although the exact number is not specified.

Recommendations: For Graphics DDK version <= 24.2 RTM2, consider updating to a version later than 24.2 RTM2 to resolve the issue. As a temporary workaround, restrict access to the GPU firmware to minimize the risk of exploitation. Avoid using the GPU firmware until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

Weakness Enumeration

CWE-823

Related Identifiers

CVE-2024-47894

Affected Products

Graphics Ddk

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-47894 · Security Note
• https://t.me/cvedetector/15128 · Telegram Post
• https://twitter.com/gothburz/status/1879293748321919363 · Twitter Post
• https://twitter.com/CVEnew/status/1878756478842245599 · Twitter Post
• https://imaginationtech.com/gpu-driver-vulnerabilities · Note
• https://t.me/cvenotify/107187 · Telegram Post
• https://twitter.com/cracbot/status/1879770625868484907 · Twitter Post