CVE-2024-12577

CVE-2024-12577 is a vulnerability in GPU drivers from Imagination Technologies, where kernel software running inside a Guest virtual machine (VM) can exploit memory shared with the GPU firmware. This allows unauthorized writes outside the Guest's virtualized GPU memory boundaries. The issue is classified under CWE-823 (Access of Uninitialized Pointer) with a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), indicating high severity due primarily to availability impacts.

A local attacker with access to the Guest VM, requiring no privileges (PR:N), can exploit this flaw with low complexity and no user interaction. Successful exploitation enables writing data beyond the allocated virtualized GPU memory, potentially resulting in limited confidentiality and integrity impacts alongside high availability disruption, such as denial of service on the GPU resources shared with the host.

Imagination Technologies has published details on mitigations in their GPU driver vulnerabilities advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. Security practitioners should consult this reference for patch availability, updated driver versions, and recommended configurations to isolate Guest VM memory from GPU firmware interactions.