Advisories · Technology
Imagination Technologies Graphics DDK.
Every CVE that names Imagination Technologies Graphics DDK among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.8 High
GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 6.5 Medium
GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.5 High
GPU DDK - Improper locking when accessing the pvr_exp_fence object
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 8.2 High
GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.8 High
GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory
- Imagination Technologies Graphics DDK
- CWE-1284
- CVSS 7.1 High
GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 7.8 High
GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 7.8 High
GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 5.5 Medium
GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.3 High
GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.8 High
GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 3.3 Low
GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndex
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.9 High
GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mapping
- Imagination Technologies Graphics DDK
- Privilege escalation
- CVSS 7.8 High
GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.8 High
GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race condition
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - Arbitrary write of read-only dmabuf
- Imagination Technologies Graphics DDK
- Privilege escalation
- CWE-274
- CVSS 7.8 High
GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 6.7 Medium
GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 4.4 Medium
GPU DDK - rgxfw_hwperf_config OOB read & write
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 4.1 Medium
GPU DDK - psContext->eDM gives OOB write
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.1 High
GPU DDK - OOB read into fwlog due to unchecked block count
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 7.1 High
GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 8.8 High
GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 7.8 High
Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 7.8 High
GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence
- Imagination Technologies Graphics DDK
- CWE-911
- CVSS 7.8 High
GPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA)
- Imagination Technologies Graphics DDK
- Race condition
- Memory corruption
- CVSS 7.8 High
GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems
- Imagination Technologies Graphics DDK
- Race condition
- Memory corruption
- CVSS 8.1 High
GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF
- Imagination Technologies Graphics DDK
- Memory corruption
- CVSS 8.1 High
GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages
- Imagination Technologies Graphics DDK
- CWE-280
- CVSS 8.4 High
GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused
- Imagination Technologies Graphics DDK
- Information disclosure
- CVSS 7.8 High
GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices
- Imagination Technologies Graphics DDK
- Race condition
- Memory corruption