PT-2025-2943 · Imagination Technologies · Imagination Technologies Graphics Ddk

Published 2025-01-13 · Updated 2025-01-16 · CVE-2024-52938

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Imagination Technologies Graphics DDK version <= 24.2 RTM2

Description The kernel software installed and running inside a Guest VM may send improper commands to the GPU Firmware to subvert reconstruction activities and trigger a write of data outside the Guest's virtualized GPU memory. This issue may allow for out-of-range pointer offset.

Recommendations For Imagination Technologies Graphics DDK version <= 24.2 RTM2, consider updating to a version later than 24.2 RTM2 to resolve the issue. As a temporary workaround, restrict access to the GPU Firmware to minimize the risk of exploitation. Avoid using the vulnerable kernel software inside a Guest VM until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

Weakness Enumeration

CWE-823

Related Identifiers

CVE-2024-52938

Affected Products

Imagination Technologies Graphics Ddk

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-52938 · Security Note
• https://t.me/cvenotify/107192 · Telegram Post
• https://twitter.com/gothburz/status/1879283690771030314 · Twitter Post
• https://imaginationtech.com/gpu-driver-vulnerabilities · Note
• https://twitter.com/CVEnew/status/1878780716823273585 · Twitter Post
• https://t.me/cvedetector/15133 · Telegram Post
• https://twitter.com/cracbot/status/1879770630633210041 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1878776282516746513 · Twitter Post