CVE-2024-43702 - Vulnerability Details - OpenCVE

Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Imaginationtech	Ddk

No data.

No data.

References

Link	Providers
https://www.imaginationtech.com/gpu-driver-vulnerabilities/

History

Sun, 01 Dec 2024 23:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Imaginationtech Imaginationtech ddk
CPEs		cpe:2.3:a:imaginationtech:ddk:-:::::::*
Vendors & Products		Imaginationtech Imaginationtech ddk
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sat, 30 Nov 2024 02:45:00 +0000

Type	Values Removed	Values Added
Description		Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page.
Title		GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages
Weaknesses		CWE-280
References		https://www.imaginationtech.com/gpu-driver-vulnerabilities/

MITRE

Status: PUBLISHED

Assigner: imaginationtech

Published: 2024-11-30T02:30:25.404Z

Updated: 2024-12-01T23:04:15.021Z

Reserved: 2024-08-15T08:21:31.533Z

Link: CVE-2024-43702

Vulnrichment

Updated: 2024-12-01T23:03:36.752Z

NVD

Status : Received

Published: 2024-11-30T03:15:13.903

Modified: 2024-12-01T23:15:06.200

Link: CVE-2024-43702

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-43702", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "state": "PUBLISHED", "assignerShortName": "imaginationtech", "dateReserved": "2024-08-15T08:21:31.533Z", "datePublished": "2024-11-30T02:30:25.404Z", "dateUpdated": "2024-12-01T23:04:15.021Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "platforms": ["Linux", "Android"], "product": "Graphics DDK", "vendor": "Imagination Technologies", "versions": [{"lessThanOrEqual": "24.2 RTM1", "status": "affected", "version": "1.13 RTM", "versionType": "custom"}, {"status": "unaffected", "version": "24.2 RTM2", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Software installed and run as a non-privileged user may conduct improper GPU system calls </span><span style=\"background-color: rgb(255, 255, 255);\">to allow unprivileged access to arbitrary physical memory page.</span>"}], "value": "Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page."}], "impacts": [{"capecId": "CAPEC-679", "descriptions": [{"lang": "en", "value": "CAPEC - CAPEC-679: Exploitation of Improperly Configured or Implemented Memory Protections (Version 3.9)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-280", "description": "CWE - CWE-280: Improper Handling of Insufficient Permissions or Privileges (4.15)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2024-11-30T02:30:25.404Z"}, "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "source": {"discovery": "UNKNOWN"}, "title": "GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "imaginationtech", "product": "ddk", "cpes": ["cpe:2.3:a:imaginationtech:ddk:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.13_rtm", "status": "affected", "lessThanOrEqual": "24.2_rtm1", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-01T23:03:49.943687Z", "id": "CVE-2024-43702", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-01T23:04:15.021Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-43702", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-01T23:03:49.943687Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:imaginationtech:ddk:-:*:*:*:*:*:*:*"], "vendor": "imaginationtech", "product": "ddk", "versions": [{"status": "affected", "version": "1.13_rtm", "versionType": "custom", "lessThanOrEqual": "24.2_rtm1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-01T23:03:36.752Z"}}], "cna": {"title": "GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-679", "descriptions": [{"lang": "en", "value": "CAPEC - CAPEC-679: Exploitation of Improperly Configured or Implemented Memory Protections (Version 3.9)"}]}], "affected": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "affected", "version": "1.13 RTM", "versionType": "custom", "lessThanOrEqual": "24.2 RTM1"}, {"status": "unaffected", "version": "24.2 RTM2", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}], "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Software installed and run as a non-privileged user may conduct improper GPU system calls </span><span style=\"background-color: rgb(255, 255, 255);\">to allow unprivileged access to arbitrary physical memory page.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-280", "description": "CWE - CWE-280: Improper Handling of Insufficient Permissions or Privileges (4.15)"}]}], "providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2024-11-30T02:30:25.404Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43702", "state": "PUBLISHED", "dateUpdated": "2024-12-01T23:04:15.021Z", "dateReserved": "2024-08-15T08:21:31.533Z", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "datePublished": "2024-11-30T02:30:25.404Z", "assignerShortName": "imaginationtech"}, "dataVersion": "5.1"}