Imagination Technologies GPU Driver Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Imagination Technologies GPU driver. This issue arises when software, executed by a non-privileged user, makes improper GPU system calls. These erroneous calls can crash the firmware running on the GPU, leading to a freeze in graphics output. The vulnerability is present in DDK releases up to and including 24.3.

Impact

Exploitation of this vulnerability causes a crash of the GPU firmware, freezing the graphics output.

Reproduction

The vulnerability can be reproduced by running software as a non-privileged user that makes improper GPU system calls. This can be done by exploiting certain kernel functions that do not properly manage memory or synchronization, leading to a crash of the GPU firmware.

Remediation

The DDK kernel module has been updated to address this vulnerability by preventing non-aligned memory accesses that could disrupt GPU operation.