CVE-2024-52938

High

Published: 13 January 2025

Published

13 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0005 15.3th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-52938 is a high-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Imaginationtech (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the vulnerability by requiring timely remediation and patching of the GPU firmware flaw exploited by improper guest kernel commands causing out-of-bounds writes.

SI-16 Memory Protection good match

prevent

Implements memory protection mechanisms to enforce boundaries on the guest's virtualized GPU memory, preventing unauthorized writes triggered by subverted reconstruction activities.

SI-10 Information Input Validation partial match

prevent

Validates information inputs such as commands posted from the guest kernel to the GPU firmware, blocking improper commands that subvert reconstruction and enable out-of-bounds access.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Out-of-bounds write from low-priv Guest VM kernel to GPU firmware directly enables local privilege escalation (T1068) via memory corruption beyond virtualization boundaries.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory.

Deeper analysisAI

CVE-2024-52938 is a vulnerability in GPU firmware from Imagination Technologies, affecting kernel software running inside a Guest virtual machine (VM). The issue arises when the Guest VM kernel posts improper commands to the GPU firmware, subverting reconstruction activities and enabling a write operation outside the boundaries of the Guest's virtualized GPU memory. This flaw, classified under CWE-823 (Access of Uninitialized Pointer), carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high-impact potential from a local, low-privilege attack vector.

An attacker with local access and low privileges (PR:L) inside the Guest VM can exploit this vulnerability without user interaction. By crafting and posting malicious commands from the Guest kernel to the GPU firmware, they can trigger out-of-bounds writes beyond the virtualized GPU memory region. This achieves high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), potentially allowing data corruption, leakage, or denial of service within the virtualized environment or beyond, depending on the GPU firmware's integration.

Imagination Technologies has published details on the vulnerability in their GPU driver vulnerabilities advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/, which security practitioners should consult for patch availability and mitigation guidance.