CVE-2025-0015
Published: 03 February 2025
Summary
CVE-2025-0015 is a high-severity Use After Free (CWE-416) vulnerability in Arm 5Th Gen Gpu Architecture Kernel Driver. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 32.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0015 is a Use After Free vulnerability (CWE-416) in the Arm Ltd Valhall GPU Kernel Driver and Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver. It enables a local non-privileged user process to perform improper GPU processing operations, resulting in access to already freed memory. The issue affects Valhall GPU Kernel Driver versions from r48p0 through r49p1 and from r50p0 through r52p0, as well as Arm 5th Gen GPU Architecture Kernel Driver versions from r48p0 through r49p1 and from r50p0 through r52p0. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-02-03.
A local attacker with low privileges (PR:L) can exploit this vulnerability without user interaction (UI:N) by submitting malicious GPU workloads through a non-privileged user process. Successful exploitation grants access to freed kernel memory, potentially allowing arbitrary code execution, data corruption, or system crashes with high impacts on confidentiality, integrity, and availability in the local attack vector (AV:L).
Mitigation details are available in the Arm Security Center advisory on Mali GPU Driver Vulnerabilities at https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1482
Vulnerability details
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to make improper GPU processing operations to gain access to already freed memory.This issue…
more
affects Valhall GPU Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0; Arm 5th Gen GPU Architecture Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel driver use-after-free enables direct exploitation for privilege escalation from low-privileged user to kernel code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the Use After Free flaw in the affected Arm GPU kernel driver versions by applying vendor-provided patches.
Implements memory protections like DEP and ASLR to prevent unauthorized code execution and data access from the Use After Free vulnerability.
Validates malicious GPU workloads submitted by local non-privileged processes to block improper operations that trigger the Use After Free.