CVE-2025-0835
Published: 24 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-0835 is a use-after-free vulnerability (CWE-416) in Imagination Technologies GPU drivers, where software installed and executed as a non-privileged user can make improper GPU system calls that corrupt kernel heap memory. The issue has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on system confidentiality, integrity, and availability.
A local attacker with low privileges, such as a standard non-privileged user, can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows the attacker to corrupt kernel heap memory, potentially enabling arbitrary kernel memory read/write operations, privilege escalation to root, or full system compromise.
Mitigation details and patches are available in the vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. Security practitioners should consult this reference for affected versions, patch deployment instructions, and any recommended workarounds.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Use-after-free in GPU kernel driver enables local privilege escalation via kernel memory corruption from low-privileged user context.