CVE-2024-47894

High

Published: 13 January 2025

Published

13 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS Score 0.0003 10.5th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-47894 is a high-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Imaginationtech (inferred from references). Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-4 (Information in Shared System Resources) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mandates identification, reporting, and timely patching of software flaws like the improper GPU driver commands enabling out-of-bounds memory reads.

SI-16 Memory Protection good match

prevent

Implements memory protection safeguards such as bounds checking and isolation to prevent unauthorized reads outside the guest VM's virtualized GPU memory.

SC-4 Information in Shared System Resources good match

prevent

Prevents unauthorized information transfer via shared GPU memory resources exploited by improper commands from the guest kernel to GPU firmware.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1611 Escape to Host Privilege Escalation

Adversaries may break out of a container or virtualized environment to gain access to the underlying host.

attack.mitre.org →

Why these techniques?

Local kernel vuln in guest GPU driver directly enables privilege escalation (T1068) and VM escape via improper GPU firmware commands allowing out-of-bound memory reads (T1611).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.

Deeper analysisAI

CVE-2024-47894 is a vulnerability (CWE-823) in kernel software installed and running inside a Guest VM, where it may post improper commands to the GPU Firmware. This enables reading data outside the Guest's virtualized GPU memory. The issue affects Imagination Technologies GPU drivers, as detailed in their vulnerability advisory, and received a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).

A local attacker with low privileges inside the Guest VM can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation allows high-impact confidentiality violations by accessing data beyond the Guest's virtualized GPU memory boundaries, alongside high availability impact that could disrupt GPU operations.

The Imagination Technologies advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ provides details on affected versions and mitigation steps, including patches for the GPU driver vulnerabilities.