Imagination Technologies GPU Driver Use-After-Free Vulnerability in Guest VMs

A use-after-free vulnerability has been identified in the GPU driver developed by Imagination Technologies. This issue affects software running as a non-privileged user within a Guest virtual machine, specifically in DDK Releases up to and including 24.3 RTM. The vulnerability arises from improper GPU system calls that trigger reads of stale data, including handles to resources with unbalanced reference counts. This mismanagement can lead to kernel exceptions and unauthorized writes, creating a use-after-free condition.

Impact

Exploitation of this vulnerability causes kernel exceptions related to use-after-free conditions, which can lead to memory corruption and potential arbitrary code execution in the kernel context.

Remediation

The DDK kernel module has been updated to address this vulnerability by correcting the improper management of GPU system calls, preventing access to stale data that could lead to use-after-free conditions.