Use-after-free in PowerVR GPU DDK - CVE-2024-43704
Published: January 6, 2025
Vulnerability identifier: #VU102381
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-43704
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in PVRSRVAcquireProcessHandleBase. A local application can cause psProcessHandleBase reuse when PIDs are reused and escalate privileges on the system.
Affected software
PowerVR GPU DDK
Samsung Mobile Firmware
Google Android
Samsung Mobile Firmware
Google Android
How to mitigate CVE-2024-43704
Install updates from vendor's website.
Samsung Mobile Firmware - update to SMR-FEB-2025
Google Android - addressed in versions 12L 2025-01-05, 12 2025-01-05, 13 2025-01-05, 14 2025-01-05, 15 2025-01-05
Google Android - addressed in versions 12L 2025-01-05, 12 2025-01-05, 13 2025-01-05, 14 2025-01-05, 15 2025-01-05