CVE-2024-12577
Published: 22 February 2025
Summary
CVE-2024-12577 is a high-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Imaginationtech (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, ranked at the 7.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-4 (Information in Shared System Resources) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Prevents unauthorized and unintended information transfer via shared system resources, directly addressing exploitation of memory shared between Guest VM kernel and GPU firmware.
Implements safeguards to protect system memory from unauthorized modification, mitigating out-of-bounds writes beyond virtualized GPU memory boundaries.
Ensures timely identification, reporting, and correction of the specific flaw in Imagination Technologies GPU drivers through patching.
NVD Description
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
Deeper analysisAI
CVE-2024-12577 is a vulnerability in GPU drivers from Imagination Technologies, where kernel software running inside a Guest virtual machine (VM) can exploit memory shared with the GPU firmware. This allows unauthorized writes outside the Guest's virtualized GPU memory boundaries. The issue is classified under CWE-823 (Access of Uninitialized Pointer) with a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), indicating high severity due primarily to availability impacts.
A local attacker with access to the Guest VM, requiring no privileges (PR:N), can exploit this flaw with low complexity and no user interaction. Successful exploitation enables writing data beyond the allocated virtualized GPU memory, potentially resulting in limited confidentiality and integrity impacts alongside high availability disruption, such as denial of service on the GPU resources shared with the host.
Imagination Technologies has published details on mitigations in their GPU driver vulnerabilities advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. Security practitioners should consult this reference for patch availability, updated driver versions, and recommended configurations to isolate Guest VM memory from GPU firmware interactions.
Details
- CWE(s)