Imagination Technologies GPU Driver TOCTOU Race Condition Vulnerability Allowing Memory Escaping from Guest VM

A vulnerability exists in the GPU driver DDK releases up to and including 25.2 RTM, allowing kernel or driver software running on a Guest VM to exploit a time-of-check to time-of-use (TOCTOU) race condition. This exploitation can lead to unauthorized reading and/or writing of data outside the designated memory, effectively escaping the virtual machine's confines. The issue arises from improper command handling to the GPU firmware, particularly related to memory contexts that are not adequately validated at the time of use.

Impact

Exploitation of this vulnerability can cause out-of-bounds read and write operations in the shared kernel and firmware memory heap, leading to potential memory corruption and unauthorized access to sensitive information.

Remediation

The DDK firmware has been updated to validate GPU memory context at the time of use, preventing the TOCTOU race condition and its associated impacts.