CVE-2024-46971CWE-362CWE-416

GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems

High · published December 13, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
2.9
In the wild
Unconfirmed
What it is

Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00138 · 2.9th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-416 · Use After Free
Published
2024-12-13T17:32Z
EPSS history
Timeline
  • 13 DEC 17:32Z
    GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems
    cvelistv5