Input validation error in ARM products - CVE-2024-6790
Published: February 3, 2025
Vulnerability identifier: #VU103505
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-6790
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input passed via an unprivileged process, including via WebGL or WebGPU. A remote attacker can trick the victim into visiting a specially crafted website and crash the device.
Affected software
Arm 5th Gen GPU Architecture Kernel Driver
Bifrost GPU Kernel Driver
Valhall GPU Kernel Driver
Bifrost GPU Kernel Driver
Valhall GPU Kernel Driver
How to mitigate CVE-2024-6790
Install updates from vendor's website.
Arm 5th Gen GPU Architecture Kernel Driver - addressed in versions r49p1, r52p0
Bifrost GPU Kernel Driver - update to r49p1
Valhall GPU Kernel Driver - addressed in versions r49p1, r52p0
Bifrost GPU Kernel Driver - update to r49p1
Valhall GPU Kernel Driver - addressed in versions r49p1, r52p0