Imagination Technologies vulnerabilities
95 CVEs and advisories name Imagination Technologies as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-25179GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory
- CVE-2024-47893GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)
- CVE-2025-1706GPU DDK - Improper locking when accessing the pvr_exp_fence object
- CVE-2025-0467GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write
- CVE-2025-25178GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory
- CVE-2025-0468GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)
- CVE-2025-0835GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails
- CVE-2025-0478GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object
- CVE-2024-12837GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size
- CVE-2024-12576GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address
- CVE-2024-12577GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet
- CVE-2024-52939GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write
- CVE-2024-47896GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndex
- CVE-2024-46975GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mapping
- CVE-2024-47900GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes
- CVE-2024-47899GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition
- CVE-2024-47898GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition
- CVE-2024-47891GPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race condition
- CVE-2024-46974GPU DDK - Arbitrary write of read-only dmabuf
- CVE-2024-52938GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write
- CVE-2024-52937GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore
- CVE-2024-52936GPU DDK - rgxfw_hwperf_config OOB read & write
- CVE-2024-52935GPU DDK - psContext->eDM gives OOB write
- CVE-2024-47895GPU DDK - OOB read into fwlog due to unchecked block count
- CVE-2024-47894GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds
- CVE-2024-47897GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write
- CVE-2024-43705GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)
- CVE-2024-46973Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement
- CVE-2024-46972GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence
- CVE-2024-47892GPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA)