CVE-2024-47894

CVE-2024-47894 is a vulnerability (CWE-823) in kernel software installed and running inside a Guest VM, where it may post improper commands to the GPU Firmware. This enables reading data outside the Guest's virtualized GPU memory. The issue affects Imagination Technologies GPU drivers, as detailed in their vulnerability advisory, and received a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).

A local attacker with low privileges inside the Guest VM can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation allows high-impact confidentiality violations by accessing data beyond the Guest's virtualized GPU memory boundaries, alongside high availability impact that could disrupt GPU operations.

The Imagination Technologies advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ provides details on affected versions and mitigation steps, including patches for the GPU driver vulnerabilities.