CVE-2024-12577
Published: 22 February 2025
Summary
CVE-2024-12577 is a high-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Imaginationtech (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-4 (Information in Shared System Resources) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-12577 is a vulnerability in GPU drivers from Imagination Technologies, where kernel software running inside a Guest virtual machine (VM) can exploit memory shared with the GPU firmware. This allows unauthorized writes outside the Guest's virtualized GPU memory boundaries. The issue is classified under CWE-823 (Access of Uninitialized Pointer) with a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), indicating high severity due primarily to availability impacts.
A local attacker with access to the Guest VM, requiring no privileges (PR:N), can exploit this flaw with low complexity and no user interaction. Successful exploitation enables writing data beyond the allocated virtualized GPU memory, potentially resulting in limited confidentiality and integrity impacts alongside high availability disruption, such as denial of service on the GPU resources shared with the host.
Imagination Technologies has published details on mitigations in their GPU driver vulnerabilities advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. Security practitioners should consult this reference for patch availability, updated driver versions, and recommended configurations to isolate Guest VM memory from GPU firmware interactions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4435
Vulnerability details
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables writes outside guest VM GPU memory isolation boundaries, directly facilitating VM escape to host via GPU firmware interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Prevents unauthorized and unintended information transfer via shared system resources, directly addressing exploitation of memory shared between Guest VM kernel and GPU firmware.
Implements safeguards to protect system memory from unauthorized modification, mitigating out-of-bounds writes beyond virtualized GPU memory boundaries.
Ensures timely identification, reporting, and correction of the specific flaw in Imagination Technologies GPU drivers through patching.