CVE-2024-47895

CVE-2024-47895 affects Imagination Technologies GPU drivers, specifically where kernel software running inside a Guest VM posts improper commands to the GPU Firmware. This flaw enables reading data outside the Guest's virtualized GPU memory, classified under CWE-823 (Access of Uninitialized Pointer). The vulnerability received a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) and was published on 2025-01-13.

A local attacker with low privileges inside the Guest VM can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation allows high-impact confidentiality violations by accessing data beyond the virtualized GPU memory boundaries, potentially exposing sensitive information from the host or other guests, alongside high availability impacts that could disrupt GPU operations.

Imagination Technologies has published details on mitigations and patches for this and related GPU driver vulnerabilities at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. Security practitioners should consult this advisory for specific remediation steps tailored to affected driver versions in virtualized environments.