A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access.
The attacker prepares a website containing malicious GPU shader code, which is then loaded and processed by the GPU compiler process. Particularly dangerous is an edge case involving the use of very large values in switch instructions in the shader code — this causes a segmentation fault in the compiler due to a write outside the permitted memory area (out-of-bounds write, CWE-787). Additionally, the vulnerability includes the use of a pointer to an incorrect memory location (CWE-823), which can result in process crash or arbitrary code execution.
An attacker can cause a crash of the GPU compiler process, and on platforms where this process runs with system privileges, potentially gain the ability to further exploit the vulnerability — including privilege escalation or code execution at the system level.
Apply patches available from the vendor in accordance with references published at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. As a risk mitigation measure, where possible, consider restricting the privileges of the GPU compiler process so it does not run with system privileges.
Imagination Technologies DDK drivers — versions indicated in vendor references (https://www.imaginationtech.com/gpu-driver-vulnerabilities/)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HImaginationtech Ddk
APPImaginationtech1.171.1823.224.1 – 25.1
Related vulnerabilities
Integer overflow w sterowniku GPU Imagination — błędne mapowanie pamięci fizycznej
Use-after-free w kompilatorze shaderów GPU biblioteki Imagination DDK
Wyciek rejestrów bezpiecznych obciążeń przez środowisko niezabezpieczone — Imagination DDK
Use-After-Free w sterowniku GPU — eskalacja uprawnień przez manipulację synchronizacją
Privilege escalation w GPU Firmware — zapis poza wirtualną pamięcią GPU gościa