Input validation error in ARM products - CVE-2024-6790
Published: February 3, 2025
Vulnerability identifier: #VU103505
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-6790
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: ARM
Affected software:
Bifrost GPU Kernel Driver
Valhall GPU Kernel Driver
Arm 5th Gen GPU Architecture Kernel Driver
Bifrost GPU Kernel Driver
Valhall GPU Kernel Driver
Arm 5th Gen GPU Architecture Kernel Driver
Detailed vulnerability description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input passed via an unprivileged process, including via WebGL or WebGPU. A remote attacker can trick the victim into visiting a specially crafted website and crash the device.
How to mitigate CVE-2024-6790
Install updates from vendor's website.